CVE-2021-4213
JSS
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 1.74 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2042900
- https://access.redhat.com/security/cve/CVE-2021-4213
- https://security-tracker.debian.org/tracker/CVE-2021-4213
- https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448
- https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-34071
- GCVE · GCVE-0-2021-4213
Affected configurations (NVD CPE)
cpe:2.3:a:dogtagpki:network_security_services_for_java:*:*:*:*:*:*:*:*< 4.9.3cpe:2.3:a:dogtagpki:network_security_services_for_java:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.1.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| JSS | affected Fixed in v5.2.0-beta1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |