Bug 2042900 (CVE-2021-4213)
| Summary: | CVE-2021-4213 JSS: memory leak in TLS connection leads to OOM | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Cedric Buissart <cbuissar> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alexander.m.scheel, cdorney, cfu, ckelley, dsirrine, edewata, elio.maldonado.batiz, jmagne, jprivett, kwright, mharmsen, mkdineshprasanth, mmillson, msauton, nkinder, rcritten, rhcs-maint, rhcs-maint, rmeggins, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jss 5.1.0, jss 4.9.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-11 05:15:27 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2046022, 2046023, 2052631, 2052632, 2142975, 2184498 | ||
| Bug Blocks: | 2042903 | ||
|
Description
Cedric Buissart
2022-01-20 10:25:49 UTC
Created jss tracking bugs for this issue: Affects: fedora-all [bug 2052632] Upstream fix : https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448 https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:1851 https://access.redhat.com/errata/RHSA-2022:1851 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-4213 *** Bug 2011102 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat Certificate System 10.4 for RHEL-8 Via RHSA-2024:0774 https://access.redhat.com/errata/RHSA-2024:0774 |