Bug 2027176 (CVE-2021-41973)

Summary:	CVE-2021-41973 mina-core: infinite loop may lead to DoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, akoufoud, alazarot, almorale, anstephe, asoldano, atangrin, ataylor, bbaranow, bibryam, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, drieden, eleandro, etirelli, fjuma, ggaughan, gmalinko, gvarsami, hbraun, ibek, iweiss, janstey, jcoleman, jnethert, jochrist, jolee, jpallich, jperkins, jrokos, jross, jschatte, jstastny, jwon, krathod, kverlaen, kwills, ldimaggi, lgao, mnovotny, msochure, msvehla, nwallace, pantinor, pdelbell, pjindal, pmackay, rguimara, rrajasek, rstancel, rsvoboda, rwagner, smaestri, tcunning, tkirby, tom.jenkinson, tzimanyi, yborgess
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mina-core 2.1.5	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-29 21:51:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2027178

Description Marian Rehak 2021-11-29 04:34:56 UTC

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected.

External Reference:

https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E
http://www.openwall.com/lists/oss-security/2021/11/01/2
http://www.openwall.com/lists/oss-security/2021/11/01/8

Comment 1 Jonathan Christison 2021-11-29 17:29:11 UTC

This vulnerability is out of security support scope for the following products:
 
 * Red Hat JBoss Enterprise Application Platform 6
 * Red Hat JBoss Fuse 6
 * Red Hat JBoss BRMS 6
 * Red Hat JBoss BPMS 6
 * Red Hat JBoss Data Virtualization 6
 * Red Hat JBoss SOA Platform 5
 * Red Hat JBoss Fuse Service Works

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 3 Product Security DevOps Team 2021-11-29 21:51:35 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-41973