Vulnerability Details : CVE-2021-4213
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Vulnerability category: Denial of service
Products affected by CVE-2021-4213
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- Dogtagpki » Network Security Services For JavaVersions from including (>=) 5.0.0 and before (<) 5.1.0cpe:2.3:a:dogtagpki:network_security_services_for_java:*:*:*:*:*:*:*:*
- cpe:2.3:a:dogtagpki:network_security_services_for_java:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-4213
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 37 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-4213
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2021-4213
-
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2021-4213
-
https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2
Additional fix for TLS connection I missed from original patch · dogtagpki/jss@3aabe0e · GitHubPatch;Third Party Advisory
-
https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448
Fix memory leak on each TLS connection · dogtagpki/jss@5922560 · GitHubPatch;Third Party Advisory
-
https://access.redhat.com/security/cve/CVE-2021-4213
CVE-2021-4213- Red Hat Customer PortalThird Party Advisory
-
https://security-tracker.debian.org/tracker/CVE-2021-4213
CVE-2021-4213Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=2042900
2042900 – (CVE-2021-4213) CVE-2021-4213 JSS: memory leak in TLS connection leads to OOMIssue Tracking;Patch;Third Party Advisory
Jump to