CVE-2021-22883

Published Mar 3, 2021

Last updated a year ago

Overview

Description: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Source: support@hackerone.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 7.8
Impact score: 6.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:N/A:C

Weaknesses

nvd@nist.gov: CWE-772
support@hackerone.com: CWE-400

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0B8440E6-CAF3-456D-A9B4-4EBF33AC3F37",
            "versionEndExcluding": "10.24.0",
            "versionStartIncluding": "10.0.0"
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4533F19F-C946-4203-8331-0317A0544D96",
            "versionEndExcluding": "12.21.0",
            "versionStartIncluding": "12.0.0"
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB0738FA-DE42-4E1A-A67D-4C6357C2D720",
            "versionEndExcluding": "14.16.0",
            "versionStartIncluding": "14.0.0"
          },
          {
            "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E640EA36-17B2-4745-A831-AB8655F3579D",
            "versionEndExcluding": "15.10.0",
            "versionStartIncluding": "15.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "058C7C4B-D692-49DE-924A-C2725A8162D3"
          },
          {
            "criteria": "cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0F0434A5-F2A1-4973-917C-A95F2ABE97D1"
          },
          {
            "criteria": "cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "96DD93E0-274E-4C36-99F3-EEF085E57655"
          },
          {
            "criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "86305E47-33E9-411C-B932-08C395C09982",
            "versionEndExcluding": "9.2.6.0"
          },
          {
            "criteria": "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1FD765AD-DEE4-41C5-9746-A2294D5F21C7",
            "versionEndIncluding": "8.0.25"
          },
          {
            "criteria": "cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D04565AE-D092-4AE0-8FEE-0E8114662A1B",
            "versionEndExcluding": "20.3"
          },
          {
            "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9"
          },
          {
            "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C8AF00C6-B97F-414D-A8DF-057E6BFD8597"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0F46497-4AB0-49A7-9453-CC26837BF253",
            "versionEndExcluding": "1.0.1.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References