Infinite loop in Apache MINA - CVE-2021-41973

Vulnerability identifier: #VU57846

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-41973

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop while processing HTTP requests. A remote attacker can consume all available system resources and cause denial of service conditions.

Apache MINA
OSS Support Tools
JD Edwards EnterpriseOne Tools
Cloudera Data Platform Private Cloud Base for IBM
openEuler
apache-mina
apache-mina-mina-filter-compression
apache-mina-javadoc
apache-mina-mina-http
apache-mina-mina-statemachine
apache-mina-mina-core
CloudLink
IBM Cognos Analytics

Install updates from vendor's website.

Apache MINA - addressed in versions 2.0.22, 2.1.5
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
JD Edwards EnterpriseOne Tools - update to 9.2.7.3
apache-mina - update to 2.0.21-2
apache-mina-mina-filter-compression - update to 2.0.21-2
apache-mina-javadoc - update to 2.0.21-2
apache-mina-mina-http - update to 2.0.21-2
apache-mina-mina-statemachine - update to 2.0.21-2
apache-mina-mina-core - update to 2.0.21-2
CloudLink - update to 8.0-3.10.5.1
IBM Cognos Analytics - addressed in versions 11.2.4 FP4, 12.0.3 IF1

• https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/11/01/2

• Denial of service in Apache MINA
• Multiple vulnerabilities in OSS Support Tools
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• Multiple vulnerabilities in Dell CloudLink
• openEuler update for apache-mina
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base with IBM (CDP)