CVE-2021-41119: falha de média gravidade em wireapp wire-server
DoS vulnerabiliity in wire-server json parser
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.4%
Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
wireapp · wire-serverCVEs relacionadas — wireapp wire-server
No mesmo produto, das mais perigosas para as menos.
CVE-2021-21396MEDIUMBulk list client endpoint exposes too much metadata about a clientEPSS 1.2%CVE-2021-41100HIGHAccount takeover when having only access to a user's short lived token in wire-serverEPSS 0.9%CVE-2023-22737MEDIUMwire-server vulnerable to unauthorized removal of Bots from ConversationsEPSS 0.8%CVE-2022-31122CRITICALWire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creationEPSS 0.7%CVE-2021-41101MEDIUMCORS `Access-Control-Allow-Origin` settings are too lenientEPSS 0.7%CVE-2022-23610CRITICALImproper Verification of Cryptographic Signature in wire-serverEPSS 0.7%