CVE-2021-4213: High severity dogtagpki Network Security Services For Java vulnerability
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Other sources
It was found that JSS did not properly free up all the memory resulting of a TLS connection. This could be used by an attacker to force the invocation of Linux's Out-Of-Memory process, causing a denial of service.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2021-4213.
What is the severity of CVE-2021-4213?
The severity of CVE-2021-4213 is high (7.5).
How does this flaw impact the affected software?
This flaw allows an attacker to cause a denial of service by forcing the invocation of an out-of-memory process, which can saturate the server's RAM.
Which software versions are affected by CVE-2021-4213?
The affected software versions include Dogtagpki Network Security Services for Java up to version 4.9.3, and versions between 5.0.0 and 5.1.0. Redhat Enterprise Linux 8.0, Debian Debian Linux 10.0, and Debian Debian Linux 11.0 are also affected.
How can I fix CVE-2021-4213?
To fix CVE-2021-4213, update the affected software to version 5.1.0 for Redhat systems or follow the available remedies for other distributions.