CVE-2021-3716 Other in nbdkit
A Man-in-the-Middle attacker can inject plaintext NBD options to terminate client sessions, causing denial of service in nbdkit.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3716?
CVE-2021-3716 is a low-severity vulnerability in Redhat Enterprise Linux, published on 2 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
Weakness: CWE-924
Which versions are affected by CVE-2021-3716?
It affects 2 products.
Linux distribution packages (1)
nbdkit openSUSE:Tumbleweed | All versions | 1.27.8-1.2 |
Products include Nbdkit Project Nbdkit, Redhat Enterprise Linux.
How do I fix CVE-2021-3716?
Apply the vendor's patch.
Is CVE-2021-3716 being exploited?
There is no known exploitation of CVE-2021-3716 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as DEBIAN-CVE-2021-3716, GHSA-3vpg-mwgf-4jvj, UBUNTU-CVE-2021-3716, openSUSE-SU-2024:11078-1.