CVE-2021-21296: Denial-of-service in Fleet
Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21296?
CVE-2021-21296 has a severity rating of medium due to its potential to cause denial of service.
How do I fix CVE-2021-21296?
To fix CVE-2021-21296, upgrade Fleet to version 3.7.0 or later.
What type of vulnerability is CVE-2021-21296?
CVE-2021-21296 is a denial of service vulnerability affecting Fleet prior to version 3.7.0.
Who is affected by CVE-2021-21296?
Any user running Fleet versions prior to 3.7.0 with a valid node key can be affected by CVE-2021-21296.
When can CVE-2021-21296 be exploited?
CVE-2021-21296 can be exploited only while a live query is currently ongoing.