CVE-2021-3690 : A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG messa

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Published 2022-08-23 16:15:09

Updated 2023-07-07 19:23:40

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2021-3690

Redhat » Jboss Enterprise Application Platform » Version: 7.3
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 6.0
When used together with: Redhat » Enterprise Linux » Version: 7.0
When used together with: Redhat » Enterprise Linux » Version: 8.0
Redhat » Jboss Enterprise Application Platform » Version: N/A Text-only Edition
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*
Matching versions
Redhat » Jboss Enterprise Application Platform » Version: 7.4
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 7.0
When used together with: Redhat » Enterprise Linux » Version: 8.0
Redhat » Undertow
Versions before (<) 2.0.40
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
Matching versions
Redhat » Undertow
Versions from including (>=) 2.1.0 and before (<) 2.2.10
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*
Matching versions
Redhat » Single Sign-on » Version: N/A Text-only Edition
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
Matching versions
Redhat » Openshift Application Runtimes » Version: N/A Text-only Edition
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*
Matching versions
Redhat » Fuse » Version: 1.0
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel K » Version: N/A
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*
Matching versions
Redhat » Integration Camel Quarkus » Version: N/A
cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2021-3690

Top countries where our scanners detected CVE-2021-3690

Top open port discovered on systems with this issue 80

IPs affected by CVE-2021-3690 4,517

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2021-3690!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2021-3690

EPSS FAQ

0.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-3690

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2021-3690

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-3690

https://issues.redhat.com/browse/UNDERTOW-1935

[UNDERTOW-1935] buffer leak on incoming websocket PONG message - Red Hat Issue Tracker
Exploit;Issue Tracking;Mitigation;Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3690

CVE-2021-3690- Red Hat Customer Portal
Vendor Advisory
https://github.com/undertow-io/undertow/commit/c7e84a0b7efced38506d7d1dfea5902366973877

[UNDERTOW-1935] - buffer leak on incoming websocket PONG message · undertow-io/undertow@c7e84a0 · GitHub
Patch;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1991299

1991299 – (CVE-2021-3690) CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS
Issue Tracking;Vendor Advisory