Resource exhaustion in JSZip - CVE-2021-23413

Vulnerability identifier: #VU55579

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23413

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

JSZip
Log Analysis
IBM Edge Application Manager
Primavera Unifier
Business Automation Insights
Asset Repository in IBM Cloud Pak for Integration (CP4I)
Dell Storage Manager

Install updates from vendor's website.

JSZip - update to 3.7.0
Log Analysis - update to 1.3.8.3
Business Automation Insights - addressed in versions 24.0.0.0.6, 24.0.1.0.6, 25.0.0.0.3
Asset Repository in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-3, 2021.2.1-1
Dell Storage Manager - update to 2020 R1.21

• https://github.com/Stuk/jszip/pull/766
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1251498
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1251499
• https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36
• https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88
• https://snyk.io/vuln/SNYK-JS-JSZIP-1251497
• https://github.com/advisories/GHSA-jg8v-48h5-wgxg
• https://www.npmjs.com/advisories/1774

• Denial of service in JSZip package for npm
• Denial of service in IBM Cloud Pak for Integration
• Multiple vulnerabilities in Primavera Unifier
• Resource exhaustion in IBM Edge Application Manager
• Multiple vulnerabilities in Dell Storage Manager
• IBM Log Analysis update for jszip
• Multiple vulnerabilities in IBM Business Automation Insights