CVE-2021-20201

A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 84.88%
Affected Products (NVD)
VendorProductVersion
spice_projectspice
𝑥
< 0.14.92
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
spice
bookworm
0.15.1-1
fixed
bullseye
0.14.3-2.1
fixed
buster
no-dsa
sid
0.15.2-1
fixed
stretch
no-dsa
trixie
0.15.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
spice
bionic
needed
focal
needed
groovy
ignored
hirsute
ignored
impish
ignored
jammy
not-affected
kinetic
ignored
lunar
ignored
mantic
ignored
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
needs-triage
xenial
needs-triage
spice-gtk
bionic
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
dne
xenial
not-affected
spice-protocol
bionic
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
dne
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libspice-client-glib-2_0-8
suse enterprise desktop 15 SP4
0.39-150400.2.13
fixed
suse enterprise desktop 15 SP5
0.41-150500.1.4
fixed
suse enterprise desktop 15 SP6
0.42-150600.1.4
fixed
suse enterprise desktop 15 SP7
0.42-150600.1.4
fixed
suse enterprise sap 15 SP4
0.39-150400.2.13
fixed
suse enterprise sap 15 SP5
0.41-150500.1.4
fixed
suse enterprise sap 15 SP6
0.42-150600.1.4
fixed
suse enterprise sap 15 SP7
0.42-150600.1.4
fixed
suse enterprise server 15 SP4
0.39-150400.2.13
fixed
suse enterprise server 15 SP5
0.41-150500.1.4
fixed
suse enterprise server 15 SP6
0.42-150600.1.4
fixed
suse enterprise server 15 SP7
0.42-150600.1.4
fixed
libspice-client-glib-helper
suse enterprise desktop 15 SP4
0.39-150400.2.13
fixed
suse enterprise desktop 15 SP5
0.41-150500.1.4
fixed
suse enterprise desktop 15 SP6
0.42-150600.1.4
fixed
suse enterprise desktop 15 SP7
0.42-150600.1.4
fixed
suse enterprise sap 15 SP4
0.39-150400.2.13
fixed
suse enterprise sap 15 SP5
0.41-150500.1.4
fixed
suse enterprise sap 15 SP6
0.42-150600.1.4
fixed
suse enterprise sap 15 SP7
0.42-150600.1.4
fixed
suse enterprise server 15 SP4
0.39-150400.2.13
fixed
suse enterprise server 15 SP5
0.41-150500.1.4
fixed
suse enterprise server 15 SP6
0.42-150600.1.4
fixed
suse enterprise server 15 SP7
0.42-150600.1.4
fixed
libspice-client-gtk-3_0-5
suse enterprise desktop 15 SP4
0.39-150400.2.13
fixed
suse enterprise desktop 15 SP5
0.41-150500.1.4
fixed
suse enterprise desktop 15 SP6
0.42-150600.1.4
fixed
suse enterprise desktop 15 SP7
0.42-150600.1.4
fixed
suse enterprise sap 15 SP4
0.39-150400.2.13
fixed
suse enterprise sap 15 SP5
0.41-150500.1.4
fixed
suse enterprise sap 15 SP6
0.42-150600.1.4
fixed
suse enterprise sap 15 SP7
0.42-150600.1.4
fixed
suse enterprise server 15 SP4
0.39-150400.2.13
fixed
suse enterprise server 15 SP5
0.41-150500.1.4
fixed
suse enterprise server 15 SP6
0.42-150600.1.4
fixed
suse enterprise server 15 SP7
0.42-150600.1.4
fixed
libspice-server-devel
suse enterprise sap 15
0.14.0-4.9.1
fixed
suse enterprise sap 15 SP1
0.14.1-4.3.1
fixed
suse enterprise sap 15 SP2
0.14.2-3.6.1
fixed
suse enterprise sap 15 SP3
0.14.3-150300.3.3.1
fixed
suse enterprise sap 15 SP4
0.15.0-150400.2.8
fixed
suse enterprise sap 15 SP7
0.15.0-150600.9.1
fixed
suse enterprise server 15
0.14.0-4.9.1
fixed
suse enterprise server 15 SP1
0.14.1-4.3.1
fixed
suse enterprise server 15 SP2
0.14.2-3.6.1
fixed
suse enterprise server 15 SP3
0.14.3-150300.3.3.1
fixed
suse enterprise server 15 SP4
0.15.0-150400.2.8
fixed
suse enterprise server 15 SP7
0.15.0-150600.9.1
fixed
libspice-server1
suse enterprise sap 12 SP4
0.12.8-18.1
fixed
suse enterprise sap 15
0.14.0-4.9.1
fixed
suse enterprise sap 15 SP1
0.14.1-4.3.1
fixed
suse enterprise sap 15 SP2
0.14.2-3.6.1
fixed
suse enterprise sap 15 SP3
0.14.3-150300.3.3.1
fixed
suse enterprise sap 15 SP4
0.15.0-150400.2.8
fixed
suse enterprise sap 15 SP7
0.15.0-150600.9.1
fixed
suse enterprise server 12 SP2
0.12.7-10.12.1
fixed
suse enterprise server 12 SP3
0.12.8-18.1
fixed
suse enterprise server 12 SP4
0.12.8-18.1
fixed
suse enterprise server 12 SP5
0.12.8-18.1
fixed
suse enterprise server 15
0.14.0-4.9.1
fixed
suse enterprise server 15 SP1
0.14.1-4.3.1
fixed
suse enterprise server 15 SP2
0.14.2-3.6.1
fixed
suse enterprise server 15 SP3
0.14.3-150300.3.3.1
fixed
suse enterprise server 15 SP4
0.15.0-150400.2.8
fixed
suse enterprise server 15 SP7
0.15.0-150600.9.1
fixed
spice-gtk-devel
suse enterprise sap 15 SP4
0.39-150400.2.13
fixed
suse enterprise sap 15 SP7
0.42-150600.1.4
fixed
suse enterprise server 15 SP4
0.39-150400.2.13
fixed
suse enterprise server 15 SP7
0.42-150600.1.4
fixed
typelib-1_0-SpiceClientGlib-2_0
suse enterprise sap 15 SP4
0.39-150400.2.13
fixed
suse enterprise sap 15 SP7
0.42-150600.1.4
fixed
suse enterprise server 15 SP4
0.39-150400.2.13
fixed
suse enterprise server 15 SP7
0.42-150600.1.4
fixed
typelib-1_0-SpiceClientGtk-3_0
suse enterprise sap 15 SP4
0.39-150400.2.13
fixed
suse enterprise sap 15 SP7
0.42-150600.1.4
fixed
suse enterprise server 15 SP4
0.39-150400.2.13
fixed
suse enterprise server 15 SP7
0.42-150600.1.4
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
spice-server
RHEL 8
0:0.14.3-4.el8
fixed
spice-server-devel
RHEL 8
0:0.14.3-4.el8
fixed
Common Weakness Enumeration
References
https://blog.qualys.com/product-tech/2011/10/31/tls-renegotiation-and-denial-of-service-attacks
https://bugzilla.redhat.com/show_bug.cgi?id=1921846
https://security.gentoo.org/glsa/202208-10
https://blog.qualys.com/product-tech/2011/10/31/tls-renegotiation-and-denial-of-service-attacks
https://bugzilla.redhat.com/show_bug.cgi?id=1921846
https://security.gentoo.org/glsa/202208-10