CVE-2021-3690
EUVD-2022-633123.08.2022, 16:15
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | fuse | 1.0 |
| redhat | integration_camel_k | - |
| redhat | integration_camel_quarkus | - |
| redhat | jboss_enterprise_application_platform | - |
| redhat | openshift_application_runtimes | - |
| redhat | single_sign-on | - |
| redhat | undertow | 𝑥 < 2.0.40 |
| redhat | undertow | 2.1.0 ≤ 𝑥 < 2.2.10 |
| redhat | jboss_enterprise_application_platform | 7.3 |
| redhat | jboss_enterprise_application_platform | 7.4 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
- CWE-401 - Missing Release of Memory after Effective LifetimeThe software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
References