Resource exhaustion in Cloud Controller - CVE-2021-22101
Published: November 16, 2021
Vulnerability identifier: #VU58173
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22101
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query.
Affected software
Cloud Controller
VMware Tanzu Application Service for VMs
VMware Tanzu Application Service for VMs
How to mitigate CVE-2021-22101
Install updates from vendor's website.
Cloud Controller - update to 1.118.0
VMware Tanzu Application Service for VMs - addressed in versions 2.7.40, 2.9.28, 2.10.20, 2.11.8, 2.12.1
VMware Tanzu Application Service for VMs - addressed in versions 2.7.40, 2.9.28, 2.10.20, 2.11.8, 2.12.1