PT-2021-14915 · Wireshark+3 · Wireshark+3

Published 2021-04-23 · Updated 2024-06-15 · CVE-2021-22207

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Wireshark versions 3.2.0 through 3.2.12 Wireshark versions 3.4.0 through 3.4.4

Description: The issue is related to excessive memory consumption in the MS-WSP dissector, which can lead to denial of service. This can be achieved via packet injection or by using a crafted capture file.

Recommendations: For Wireshark versions 3.2.0 through 3.2.12, update to a version that fixes the issue. For Wireshark versions 3.4.0 through 3.4.4, update to a version that fixes the issue. As a temporary workaround, consider disabling the MS-WSP dissector until a patch is available.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2021-1721

ALT-PU-2021-1737

ALT-PU-2022-1368

AZL-7405

CVE-2021-22207

DLA-2849-1

DSA-5019-1

MGASA-2021-0222

OESA-2022-1610

OPENSUSE-SU-2021:0909-1

OPENSUSE-SU-2021:2125-1

OPENSUSE-SU-2021_0909-1

OPENSUSE-SU-2021_2125-1

OPENSUSE-SU-2024:11513-1

SUSE-SU-2021:2125-1

Affected Products

Alt Linux

Astra Linux

Suse

Wireshark

References · 213

• 🔥 https://gitlab.com/wireshark/wireshark/-/issues/17331 · Exploit
• https://ubuntu.com/security/CVE-2021-22207 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22207 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22207 · Security Note
• https://debian.org/security/2021/dsa-5019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22207 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-22207 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIWWO27HV4HUKXV6NH6ULHCRAQB26DMD · Vendor Advisory
• https://osv.dev/vulnerability/AZL-7405 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NL7ZTMMWIEPHHFK3ONRKATWE7CLIGLFD · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0222.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0909-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22191 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-22207 · Vendor Advisory