CVE-2021-3716

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
nbdkit_projectnbdkit
1.11.8 ≤
𝑥
< 1.24.6
nbdkit_projectnbdkit
1.25.1 ≤
𝑥
< 1.26.5
nbdkit_projectnbdkit
1.27.1 ≤
𝑥
< 1.27.6
redhatenterprise_linux
8.0
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nbdkit
bullseye
no-dsa
buster
not-affected
stretch
not-affected
bookworm
1.32.5-1
fixed
trixie
1.40.2-2
fixed
sid
1.40.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nbdkit
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
focal
needs-triage
bionic
dne
xenial
needs-triage
trusty
dne
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1994695
https://gitlab.com/nbdkit/nbdkit/-/commit/09a13dafb7bb3a38ab52eb5501cba786365ba7fd
https://gitlab.com/nbdkit/nbdkit/-/commit/6c5faac6a37077cf2366388a80862bb00616d0d8
https://listman.redhat.com/archives/libguestfs/2021-August/msg00083.html
https://www.openwall.com/lists/oss-security/2021/08/18/2
https://bugzilla.redhat.com/show_bug.cgi?id=1994695
https://gitlab.com/nbdkit/nbdkit/-/commit/09a13dafb7bb3a38ab52eb5501cba786365ba7fd
https://gitlab.com/nbdkit/nbdkit/-/commit/6c5faac6a37077cf2366388a80862bb00616d0d8
https://listman.redhat.com/archives/libguestfs/2021-August/msg00083.html
https://www.openwall.com/lists/oss-security/2021/08/18/2