CVE-2021-3859

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Invocation of Process Using Visible Sensitive Information pada redhat jboss enterprise application platform, redhat single sign-on +4 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Rincian

Terbit di NVD

26 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-214: Invocation of Process Using Visible Sensitive Information
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-3859 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2010378 issue tracking · advisory vendor
• https://issues.redhat.com/browse/UNDERTOW-1979 issue tracking · patch · advisory vendor
• https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2 patch · advisory pihak ketiga
• https://github.com/undertow-io/undertow/pull/1296 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20221201-0004/ advisory pihak ketiga