PT-2021-14852 · Unknown · Cloud Controller

Published 2021-10-27 · Updated 2021-10-29 · CVE-2021-22101

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloud Controller versions prior to 1.118.0

Description The issue allows unauthenticated attackers to cause denial of service by using REST HTTP requests with label selectors on multiple V3 endpoints, generating an enormous SQL query. This can lead to a denial of service.

Recommendations For Cloud Controller versions prior to 1.118.0, update to version 1.118.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the V3 endpoints or limiting the use of label selectors in REST HTTP requests until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-22101

Affected Products

Cloud Controller

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-22101 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22101 · Vendor Advisory
• https://cloudfoundry.org/blog/cve-2021-22101-cloud-controller-is-vulnerable-to-unauthenticated-denial-of-service · Vendor Advisory
• https://t.me/cibsecurity/31275 · Telegram Post