7.5

CVE-2021-3859

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Single Sign-on Version7.4.10
Redhat ≫ Single Sign-on Version7.5.1
Redhat ≫ Undertow Version < 2.2.15
Netapp ≫ Cloud Secure Agent Version-
Netapp ≫ Oncommand Insight Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.9% 0.748
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-214 Invocation of Process Using Visible Sensitive Information

A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

https://issues.redhat.com/browse/UNDERTOW-1979
Patch
Vendor Advisory
Issue Tracking