Resource exhaustion in Nomad - CVE-2021-44717

Vulnerability identifier: #VU59042

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-44717

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing HTTP/2 requests. A remote attacker can send multiple HTTP/2 requests to the server and exhaust all available memory resources.

Nomad
Red Hat OpenShift Serverless
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
Gentoo Linux
Amazon Linux AMI
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE CaaS Platform
Fedora
SUSE Enterprise Storage
Anolis OS
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openEuler
containernetworking-plugins (Red Hat package)
runc (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
python-oslo-metrics (Red Hat package)
python-autopage (Red Hat package)
python-scciclient (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
openshift-serverless-clients (Red Hat package)
skopeo (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
fuse-overlayfs (Red Hat package)
crun (Red Hat package)
delve
golang-help
golang-devel
golang
containers-common (Red Hat package)
golang-tests
golang-src
golang-misc
golang-docs
golang-race
golang-bin
go-toolset
go-toolset-1.16-golang (Red Hat package)
go-toolset-1.16 (Red Hat package)
go1.16-race
go1.16-doc
go1.16
go1.17
go1.17-doc
go1.17-race
buildah (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
haproxy (Red Hat package)
python-debtcollector (Red Hat package)
kata-containers (Red Hat package)
python-osc-lib (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
python-proliantutils (Red Hat package)
ignition (Red Hat package)
openvswitch2.16 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
python-cachetools (Red Hat package)
python-oslo-context (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-cliff (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironicclient (Red Hat package)
python-oslo-utils (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
kubevirt (Red Hat package)
python-oslo-i18n (Red Hat package)
python-ironic-lib (Red Hat package)
rust-afterburn (Red Hat package)
python-pbr (Red Hat package)
mcg (Red Hat package)
python-dracclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-config (Red Hat package)
python-oslo-db (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-oslo-messaging (Red Hat package)
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
ovn-2021 (Red Hat package)
ovn21.12 (Red Hat package)
redhat-release-coreos (Red Hat package)
Red Hat Developer Tools
IBM Cloud Private
DataPower Operator
IBM Cloud Pak for Multicloud Management Monitoring
IBM Cloud Automation Manager
IBM Cloud Pak for Multicloud Management Security Services
IBM Cloud Pak System
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
OpenShift Serverless Client
IBM DataPower Gateway
Splunk Enterprise
Brownfield Connectivity - Gateway

Install updates from vendor's website.

Nomad - addressed in versions 1.0.15, 1.1.9, 1.2.3
containernetworking-plugins (Red Hat package) - addressed in versions 0.9.1-1.rhaos4.10.el8, 0.9.1-2.rhaos4.10.el8
Red Hat OpenShift Serverless - update to 1.21.0
runc (Red Hat package) - addressed in versions 1.0.1-3.rhaos4.10.git4144b63.el7, 1.1.0-1.rhaos4.10.el8, 1.1.0-2.rhaos4.10.el8
DataPower Operator - addressed in versions 1.2.7, 1.5.1
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 5
IBM Cloud Pak System - update to 2.3.3.5
IBM Cloud Private - addressed in versions 3.2.1.2203, 3.2.2.2203
OpenShift Virtualization - addressed in versions 4.9.4, 4.10.0, 4.11.0, 4.12.0
Red Hat OpenShift Container Platform - addressed in versions 4.10.3, 4.10.5, 4.12.4
openshift-ansible (Red Hat package) - addressed in versions 4.10.0-202202110258.p0.g25af5a6.assembly.stream.el7, 4.10.0-202203112237.p0.g7ca0181.assembly.stream.el7
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7, 4.10.0-202202160023.p0.gf93da17.assembly.stream.el8, 4.10.0-202203141248.p0.g6db43e2.assembly.stream.el7, 4.10.0-202203141248.p0.g6db43e2.assembly.stream.el8
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.1.1
toolbox (Red Hat package) - update to 0.0.8-4.rhaos4.10.el8
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.10.el8
python-oslo-metrics (Red Hat package) - update to 0.3.0-0.20211020174122.43eee50.el8
python-autopage (Red Hat package) - update to 0.4.0-1.el8
python-scciclient (Red Hat package) - update to 0.11.1-0.20211208154124.a84332b.el8
coreos-installer (Red Hat package) - update to 0.12.0-1.rhaos4.10.el8
butane (Red Hat package) - update to 0.14.0-1.rhaos4.10.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.10.el8
python-hardware (Red Hat package) - update to 0.29.0-0.20211122094056.7662a1d.el8
python-openstacksdk (Red Hat package) - update to 0.59.0-0.20211012172340.d0d4d8b.el8
openshift-serverless-clients (Red Hat package) - update to 1.0.0-2.el8
skopeo (Red Hat package) - update to 1.2.2-1.rhaos4.10.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.4.0-0.20211012144915.3ca8698.el8
fuse-overlayfs (Red Hat package) - update to 1.4.0-1.rhaos4.10.el8
crun (Red Hat package) - update to 1.4.2-1.rhaos4.10.el8
Migration Toolkit for Containers - addressed in versions 1.5.4, 1.7.1
delve - update to 1.6.0-1
Brownfield Connectivity - Gateway - update to 1.10.1
golang-help - update to 1.15.7-13
golang-devel - update to 1.15.7-13
golang - update to 1.15.7-13
containers-common (Red Hat package) - update to 1-16.rhaos4.10.el8
golang-tests - update to 1.16.12-1
golang-src - update to 1.16.12-1
golang-misc - update to 1.16.12-1
golang-docs - update to 1.16.12-1
golang-race - update to 1.16.12-1
golang-bin - update to 1.16.12-1
golang - update to 1.16.12-1
go-toolset - update to 1.16.12-1
go-toolset-1.16-golang (Red Hat package) - update to 1.16.12-1.el7_9
go-toolset-1.16 (Red Hat package) - update to 1.16.12-1.el7_9
golang - addressed in versions 1.16.12-1.fc34, 1.16.12-1.fc35, 1.16.13-2.el7
go1.16-race - update to 1.16.12-1.37.2
go1.16-doc - update to 1.16.12-1.37.2
go1.16 - update to 1.16.12-1.37.2
golang - addressed in versions 1.16.15-1.37, 1.19.3-2
go1.17 - update to 1.17.5-1.14.2
go1.17-doc - update to 1.17.5-1.14.2
go1.17-race - update to 1.17.5-1.14.2
buildah (Red Hat package) - update to 1.19.7-1.el8
OpenShift Serverless Client - update to 1.21.0
cri-tools (Red Hat package) - addressed in versions 1.23.0-1.el7, 1.23.0-1.el8
cri-o (Red Hat package) - addressed in versions 1.23.0-92.rhaos4.10.gitdaab4d1.el7, 1.23.1-9.rhaos4.10.gitbdffb9a.el8
haproxy (Red Hat package) - update to 2.2.19-1.el8
IBM Cloud Pak for Multicloud Management Security Services - update to 2.3 Fix Pack 6
python-debtcollector (Red Hat package) - update to 2.3.0-0.20211012161119.0bf5bf5.el8
kata-containers (Red Hat package) - update to 2.3.0-3.el8
python-osc-lib (Red Hat package) - update to 2.4.2-0.20211012163041.415a6c7.el8
python-oslo-service (Red Hat package) - update to 2.6.0-0.20211012154519.091fd65.el8
python-tooz (Red Hat package) - update to 2.9.0-0.20211012145018.174065f.el8
python-proliantutils (Red Hat package) - update to 2.12.2-0.20211210161243.500f518.el8
ignition (Red Hat package) - update to 2.13.0-2.rhaos4.10.el8
openvswitch2.16 (Red Hat package) - update to 2.16.0-33.el8fdp
jenkins (Red Hat package) - update to 2.319.2.1643288987-1.el8
podman (Red Hat package) - update to 3.0.1-7.rhaos4.10.el8
python-sushy-oem-idrac (Red Hat package) - update to 3.0.2-0.20211011174039.9733d23.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 3.1.0-0.20211130174057.d25ba32.el8
python-cachetools (Red Hat package) - update to 3.1.0-2.el8ost
python-oslo-context (Red Hat package) - update to 3.3.1-0.20211012152439.641a1e0.el8
python-stevedore (Red Hat package) - update to 3.4.0-0.20211012153718.8846a3f.el8
python-oslo-policy (Red Hat package) - update to 3.8.2-0.20211012161944.c7fd9f4.el8
python-cliff (Red Hat package) - update to 3.9.0-0.20211020191737.734bc0c.el8
python-sushy (Red Hat package) - update to 4.0.0-0.20211209155954.45d24d4.el8
python-oslo-serialization (Red Hat package) - update to 4.2.0-0.20211012151454.2b94a4f.el8
python-keystoneauth1 (Red Hat package) - update to 4.4.0-0.20211012144044.112bcae.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.1-0.20211012150632.8e08400.el8
python-oslo-log (Red Hat package) - update to 4.6.0-0.20211012154701.41c8807.el8
python-ironicclient (Red Hat package) - update to 4.9.0-0.20211209154934.6f1be06.el8
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.10.0
python-oslo-utils (Red Hat package) - update to 4.10.0-0.20211012164840.2c74bb9.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.10.0-202202160023.p0.g39cfc66.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.10.0-202202160023.p0.ge77f917.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7, 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.10.1643404185-1.el8
kubevirt (Red Hat package) - addressed in versions 4.12.0-1057.el7, 4.12.0-1057.el8
python-oslo-i18n (Red Hat package) - update to 5.1.0-0.20211012165753.b031d17.el8
python-ironic-lib (Red Hat package) - update to 5.1.0-0.20211209154936.731e2f9.el8
rust-afterburn (Red Hat package) - update to 5.2.0-1.rhaos4.10.el8
python-pbr (Red Hat package) - update to 5.5.1-1.el8ost
mcg (Red Hat package) - update to 5.10.0-72.el8
python-dracclient (Red Hat package) - update to 7.0.0-0.20211012182751.d26664e.el8
openstack-ironic-python-agent (Red Hat package) - update to 8.3.1-0.20220105174059.d2d3cd6.el8
python-oslo-config (Red Hat package) - update to 8.7.1-0.20211012155707.1a7bd66.el8
python-oslo-db (Red Hat package) - update to 9.1.0-0.20211020204148.be2cc6a.el8
IBM DataPower Gateway - addressed in versions 10.0.1.6, 10.0.4.0sr1, 10.5.0.0
openstack-ironic-inspector (Red Hat package) - update to 10.9.1-0.20220117094044.19e2592.el8
python-oslo-messaging (Red Hat package) - update to 12.9.1-0.20211020204149.f9de265.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220120204037.438b8af.el8
ovn21.09 (Red Hat package) - update to 21.09.0-22.el8fdp
ovn-2021 (Red Hat package) - update to 21.12.0-15.el8fdp
ovn21.12 (Red Hat package) - update to 21.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 410.84-2.el8

• https://github.com/hashicorp/nomad/releases/tag/v1.2.3
• https://github.com/hashicorp/nomad/releases/tag/v1.0.15
• https://github.com/hashicorp/nomad/releases/tag/v1.1.9

• Multiple vulnerabilities in nomad
• Red Hat Developer Tools update for go-toolset-1.16 and go-toolset-1.16-golang
• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Serverless
• IBM Cloud Private update for Golang
• SUSE update for go1.16
• SUSE update for go1.17
• Denial of service in IBM DataPower Operator
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Go
• Multiple vulnerabilities in OpenShift Virtualization 4.9
• Multiple vulnerabilities in OpenShift Virtualization
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Siemens Brownfield Connectivity Gateway
• Amazon Linux AMI update for golang
• Resource exhaustion in IBM Cloud Automation Manager
• Splunk Enterprise update for third-party packages
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Security Services
• openEuler update for golang
• Amazon Linux AMI update for golang
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Serverless Client 1.21
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.10
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.10
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Fedora 34 update for golang
• Fedora 35 update for golang
• Fedora EPEL 7 update for golang
• Multiple vulnerabilities in IBM DataPower Gateway
• Anolis OS update for go-toolset:an8 module