CVE-2021-41973

Опубликовано: 01 нояб. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Ссылки

http://www.openwall.com/lists/oss-security/2021/11/01/2
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/01/8
Mailing List
Third Party Advisory
https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
Mailing List
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/01/2
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/11/01/8
Mailing List
Third Party Advisory
https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
Mailing List
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:*

Версия до 2.0.22 (исключая)

cpe:2.3:a:apache:mina:*:*:*:*:*:*:*:*

Версия от 2.1.0 (включая) до 2.1.5 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:oracle:banking_payments:14.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:banking_treasury_management:14.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:flexcube_universal_banking:*:*:*:*:*:*:*:*

Версия от 14.0 (включая) до 14.3 (включая)

cpe:2.3:a:oracle:flexcube_universal_banking:14.5:*:*:*:*:*:*:*

cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:oss_support_tools:2.12.42:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00725

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-835

Связанные уязвимости

CVE-2021-41973

CVSS3: 6.5

ubuntu

больше 4 лет назад

CVE-2021-41973

CVSS3: 6.5

redhat

больше 4 лет назад

CVE-2021-41973

CVSS3: 6.5

debian

больше 4 лет назад

In Apache MINA, a specifically crafted, malformed HTTP request may cau ...

GHSA-6mcm-j9cj-3vc3

CVSS3: 6.5

github

больше 4 лет назад

Infinite loop in Apache MINA

EPSS

Процентиль: 72%

0.00725

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-835