Vulnerability Details : CVE-2021-3716
A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
Products affected by CVE-2021-3716
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
- cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*
- cpe:2.3:a:nbdkit_project:nbdkit:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-3716
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 45 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3716
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:N/A:P |
6.8
|
2.9
|
NIST | |
3.1
|
LOW | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
1.6
|
1.4
|
NIST |
CWE ids for CVE-2021-3716
-
The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2021-3716
-
https://www.openwall.com/lists/oss-security/2021/08/18/2
oss-security - Re: STARTTLS vulnerabilitiesMailing List;Third Party Advisory
-
https://gitlab.com/nbdkit/nbdkit/-/commit/6c5faac6a37077cf2366388a80862bb00616d0d8
server: reset meta context replies on starttls (6c5faac6) · Commits · nbdkit / nbdkit · GitLabPatch;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1994695
1994695 – (CVE-2021-3716) CVE-2021-3716 nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLSIssue Tracking;Patch;Third Party Advisory
-
https://gitlab.com/nbdkit/nbdkit/-/commit/09a13dafb7bb3a38ab52eb5501cba786365ba7fd
server: CVE-2021-3716 reset structured replies on starttls (09a13daf) · Commits · nbdkit / nbdkit · GitLabPatch;Third Party Advisory
Jump to