Bug 2042900 (CVE-2021-4213) - CVE-2021-4213 JSS: memory leak in TLS connection leads to OOM
Summary: CVE-2021-4213 JSS: memory leak in TLS connection leads to OOM
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-4213
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 2011102 (view as bug list)
Depends On: 2052632 2142975 2046022 2046023 2052631
Blocks: 2042903
TreeView+ depends on / blocked
 
Reported: 2022-01-20 10:25 UTC by Cedric Buissart
Modified: 2022-11-15 16:50 UTC (History)
18 users (show)

Fixed In Version: jss 5.1.0, jss 4.9.3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Clone Of:
Environment:
Last Closed: 2022-05-11 05:15:27 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 6956876 0 None None None 2022-09-13 11:50:06 UTC
Red Hat Product Errata RHSA-2022:1851 0 None None None 2022-05-10 13:49:26 UTC

Description Cedric Buissart 2022-01-20 10:25:49 UTC
It was found that JSS did not properly free up all the memory resulting of a TLS connection. This could be used by an attacker to force the invocation of Linux's Out-Of-Memory process, causing a denial of service.

Comment 8 Cedric Buissart 2022-02-09 16:56:56 UTC
Created jss tracking bugs for this issue:

Affects: fedora-all [bug 2052632]

Comment 14 errata-xmlrpc 2022-05-10 13:49:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1851 https://access.redhat.com/errata/RHSA-2022:1851

Comment 15 Product Security DevOps Team 2022-05-11 05:15:25 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-4213

Comment 16 Petr Čech 2022-09-13 11:50:07 UTC
*** Bug 2011102 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.