What is the severity of CVE-2021-21369?

The severity of CVE-2021-21369 is classified as medium due to its potential denial-of-service impact.

How do I fix CVE-2021-21369?

To fix CVE-2021-21369, upgrade Hyperledger Besu to version 1.5.1 or later.

Which versions of Besu are affected by CVE-2021-21369?

CVE-2021-21369 affects all versions of Hyperledger Besu prior to 1.5.1.

What type of attack does CVE-2021-21369 involve?

CVE-2021-21369 involves a denial-of-service attack that exploits the HTTP JSON-RPC API service.

Is authentication necessary to exploit CVE-2021-21369?

Yes, the vulnerability can be exploited if username and password authentication is enabled for the HTTP JSON-RPC API service.

Vulnerability/
CVE-2021-21369

medium

6.5

CWE

400

9/3/2021

3/8/2024

CVE-2021-21369: Potential DoS in Besu HTTP JSON-RPC API

First published: Tue Mar 09 2021(Updated: )

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Hyperledger Besu	<1.5.1

Remedy

https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022

Remedy

https://github.com/hyperledger/besu/pull/1144

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2021-21369?
The severity of CVE-2021-21369 is classified as medium due to its potential denial-of-service impact.
How do I fix CVE-2021-21369?
To fix CVE-2021-21369, upgrade Hyperledger Besu to version 1.5.1 or later.
Which versions of Besu are affected by CVE-2021-21369?
CVE-2021-21369 affects all versions of Hyperledger Besu prior to 1.5.1.
What type of attack does CVE-2021-21369 involve?
CVE-2021-21369 involves a denial-of-service attack that exploits the HTTP JSON-RPC API service.
Is authentication necessary to exploit CVE-2021-21369?
Yes, the vulnerability can be exploited if username and password authentication is enabled for the HTTP JSON-RPC API service.

agent/type
agent/references
agent/remedy
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/title
agent/weakness
agent/author
agent/description
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/linuxfoundation
canonical/hyperledger besu

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.