CVE-2021-22235 Denial of service in Wireshark

High 7.5 Published 20 Jul 2021 Updated 3 Aug 2024

Attackers can cause a denial of service in Wireshark via crafted packets or capture files due to a crash in the DNP dissector.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-22235?

CVE-2021-22235 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 20 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file

Weakness: CWE-835

Which versions are affected by CVE-2021-22235?

It affects 2 products.

Linux distribution packages (6)

`wireshark` SUSE:Linux Enterprise Module for Basesystem 15 SP2	All versions	`3.4.7-3.59.1`
`wireshark` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`3.4.7-3.59.1`
`wireshark` SUSE:Linux Enterprise Module for Desktop Applications 15 SP2	All versions	`3.4.7-3.59.1`
`wireshark` SUSE:Linux Enterprise Module for Desktop Applications 15 SP3	All versions	`3.4.7-3.59.1`
`wireshark` openSUSE:Leap 15.2	All versions	`3.4.7-lp152.2.18.1`
`wireshark` openSUSE:Leap 15.3	All versions	`3.4.7-3.59.1`

Products include Debian Debian Linux, Wireshark Wireshark.

How do I fix CVE-2021-22235?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-22235 being exploited?

There is no known exploitation of CVE-2021-22235 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-7407, DEBIAN-CVE-2021-22235, GHSA-c9h4-m6h9-v7wx, MGASA-2021-0364, SUSE-SU-2021:3017-1, UBUNTU-CVE-2021-22235 and 2 more.