CVE-2021-41973: apache mina +8 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-41973

CVSS 6.5 · Medium EPSS 4,6%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada apache mina, oracle banking payments +7 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Rincian

Terbit di NVD: 1 November 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
EPSS (30 hari): 4,6% peluang dieksploitasi; lebih tinggi dari 91,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	mina	Semua versi sebelum 2.0.22
apache	mina	Versi 2.1.0 hingga sebelum 2.1.5
oracle	banking payments	Versi 14.5
oracle	banking trade finance process management	Versi 14.5
oracle	banking treasury management	Versi 14.5
oracle	communications cloud native core console	Versi 1.9.0
oracle	customer management and segmentation foundation	Versi 18.0
oracle	customer management and segmentation foundation	Versi 19.0
oracle	flexcube universal banking	Versi 14.0 hingga 14.3
oracle	flexcube universal banking	Versi 14.5
oracle	fusion middleware common libraries and tools	Versi 12.2.1.3.0
oracle	fusion middleware common libraries and tools	Versi 12.2.1.4.0
oracle	fusion middleware common libraries and tools	Versi 14.1.1.0.0
oracle	oss support tools	Versi 2.12.42

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.a... mailing list · patch · advisory vendor
http://www.openwall.com/lists/oss-security/2021/11/01/2 mailing list · patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2021/11/01/8 mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.