CVE-2021-3859 Undertow vulnerable to Denial of Service (DoS) attacks
An attacker can cause a denial of service in Undertow by triggering client-side invocation timeouts over HTTP2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3859?
CVE-2021-3859 is a high-severity denial of service vulnerability in Netapp Cloud Secure Agent, published on 26 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
Which versions are affected by CVE-2021-3859?
2 open source packages ship an affected version, including io.undertow:undertow-core. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
io.undertow:undertow-core Maven | All versions | 2.2.15 |
io.undertow:undertow-core Maven | All versions | 2.2.15 |
Linux distribution packages (3)
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.3::el6 | All versions | 0:2.0.41-2.SP2_redhat_00001.1.el6eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.3::el7 | All versions | 0:2.0.41-2.SP2_redhat_00001.1.el7eap |
eap7-undertow Red Hat:jboss_enterprise_application_platform:7.3::el8 | All versions | 0:2.0.41-2.SP2_redhat_00001.1.el8eap |
Products include Netapp Cloud Secure Agent, Netapp Oncommand Insight, Netapp Oncommand Workflow Automation, Redhat Jboss Enterprise Application Platform, Redhat Single Sign-On, Redhat Undertow.
How do I fix CVE-2021-3859?
Upgrade io.undertow:undertow-core to 2.2.15 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-3859 being exploited?
There is no known exploitation of CVE-2021-3859 in the wild and no public exploit code.
Other vulnerabilities in Netapp Cloud Secure Agent
Sources
Also known as DEBIAN-CVE-2021-3859, GHSA-339q-62wm-c39w, RHSA-2022:0405, UBUNTU-CVE-2021-3859.