Lucene search

K
atlassianSecurity-metrics-botJRASERVER-73070
HistoryNov 30, 2021 - 6:48 p.m.

Denial of service via an OutOfMemoryError (Tomcat CVE-2021-42340)

2021-11-3018:48:53
security-metrics-bot
jira.atlassian.com
29

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.019 Low

EPSS

Percentile

88.1%

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to impact the application’s availability via CVE-2021-42340, a Denial of Service (DoS) vulnerability in Apache Tomcat.

The affected versions of Atlassian Jira Server and Data Center are before version 8.21.0.

Affected versions:

  • version < 8.21.0

Fixed versions:

  • 8.21.0

h3. Workaround

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.019 Low

EPSS

Percentile

88.1%

Related for JRASERVER-73070