Lucene search

[email protected]CVE-2021-41973

HistoryNov 01, 2021 - 9:15 a.m.

CVE-2021-41973

2021-11-0109:15:09

CWE-835

[email protected]

web.nvd.nist.gov

apache mina

cve-2021-41973

http header

decoder

nvd

security update

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.5%

JSON

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.

Affected configurations

Vulners

NVD

Node

apacheminaRange≤2.1.5

CPENameOperatorVersion
apache:minaapache minalt2.0.22
apache:minaapache minalt2.1.5

CPE	Name	Operator	Version
apache:mina	apache mina	lt	2.0.22
apache:mina	apache mina	lt	2.1.5

CNA Affected

[
  {
    "product": "Apache MINA",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "changes": [
          {
            "at": "2.0.22",
            "status": "unaffected"
          }
        ],
        "lessThan": "2.1.5",
        "status": "affected",
        "version": "Apache MINA",
        "versionType": "custom"
      }
    ]
  }
]