PT-2021-14451 · Hyperledger · Hyperledger Besu

Ian Cusden · Published 2021-03-09 · Updated 2021-03-16 · CVE-2021-21369

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hyperledger Besu versions prior to 1.5.1

Description The issue involves a denial-of-service vulnerability in the HTTP JSON-RPC API service. When username and password authentication is enabled, an attacker can overload the login endpoint with invalid requests, causing the processing of other valid requests to fail. This is because the password validity check is performed on the main event loop and takes a relatively long time. A valid username is required to expose this issue.

Recommendations For versions prior to 1.5.1, update to version 1.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the login endpoint or disabling username and password authentication for the HTTP JSON-RPC API service until the update can be applied.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-21369

GHSA-QGFJ-MJPC-7W3Q

Affected Products

Hyperledger Besu

References · 6

• https://github.com/hyperledger/besu/pull/1144 · Patch
• https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21369 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21369 · Vendor Advisory
• https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 · Note
• https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q · Note