CVE-2021-3690
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD
Description
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
Affected (10)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 1.0 | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| Before 2.0.40 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 7.3 |
| Running on/with | Platform Versions |
|---|---|
Redhat Enterprise Linux | Version 6.0 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 7.4 |
| Running on/with | Platform Versions |
|---|---|
Redhat Enterprise Linux | Version 7.0 |
Related CWEs
CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-401
Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
References (8)
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: secalert@redhat.com
ExploitIssue TrackingMitigationVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingMitigationVendor Advisory
Timeline
No history available yet.