CVE-2021-28667 Denial of service in n/a
An attacker can cause a denial of service via infinite loop and resource exhaustion when logging Unicode data in specific non-default configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28667?
CVE-2021-28667 is a high-severity denial of service vulnerability in n/a, published on 18 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data (from an action or rule name).
Weakness: CWE-835
Which versions are affected by CVE-2021-28667?
It affects 1 product.
Products include Stackstorm Stackstorm.
How do I fix CVE-2021-28667?
No fix has been published for CVE-2021-28667 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-28667 being exploited?
There is no known exploitation of CVE-2021-28667 in the wild and no public exploit code.