Resource management error in Undertow - CVE-2021-3859

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60243

Resource management error in Undertow - CVE-2021-3859

Published: February 2, 2022 / Updated: February 3, 2022


Vulnerability identifier: #VU60243
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3859
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper handling of client side invocation timeout within the application when handling HTTP/2 requests. A remote attacker can send specially crafted requests to the application and perform a denial of service (DoS) attack.


Affected software

Undertow
JBoss Enterprise Application Platform
Red Hat Single Sign-On
eap7-jboss-annotations (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-h2database (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-undertow (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-wildfly (Red Hat package)
rh-sso7-keycloak (Red Hat package)

How to mitigate CVE-2021-3859

Install updates from vendor's website.

Undertow - update to 2.2.14
JBoss Enterprise Application Platform - update to 7.3.11
Red Hat Single Sign-On - addressed in versions 7.4.10, 7.5.1
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap7-log4j-jboss-logmanager (Red Hat package) - update to 1.2.2-2.Final_redhat_00002.1.el7eap
eap7-h2database (Red Hat package) - update to 1.4.197-3.redhat_00004.1.el7eap
eap7-jboss-server-migration (Red Hat package) - update to 1.7.2-12.Final_redhat_00013.1.el7eap
eap7-avro (Red Hat package) - update to 1.7.6-8.redhat_00003.1.el7eap
eap7-jboss-marshalling (Red Hat package) - update to 2.0.15-1.Final_redhat_00001.1.el7eap
eap7-undertow (Red Hat package) - addressed in versions 2.0.41-2.SP2_redhat_00001.1.el6eap, 2.0.41-2.SP2_redhat_00001.1.el7eap, 2.0.41-2.SP2_redhat_00001.1.el8eap
eap7-xml-security (Red Hat package) - update to 2.2.3-2.redhat_00001.1.el7eap
eap7-wss4j (Red Hat package) - update to 2.3.3-2.redhat_00001.1.el7eap
eap7-xalan-j2 (Red Hat package) - update to 2.7.1-38.redhat_00015.1.el7eap
eap7-apache-cxf (Red Hat package) - update to 3.4.10-1.SP1_redhat_00001.1.el7eap
eap7-jboss-xnio-base (Red Hat package) - update to 3.7.13-1.Final_redhat_00001.1.el7eap
eap7-wildfly (Red Hat package) - update to 7.3.11-4.GA_redhat_00002.1.el7eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.4-1.redhat_00003.1.el7sso, 15.0.4-1.redhat_00003.1.el8sso

External References

Related Security Bulletins