PT-2021-17890 · Python+1 · Python+1

Tomaz Muraus · Published 2021-03-18 · Updated 2022-05-24 · CVE-2021-28667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: StackStorm versions prior to 3.4.1

Description: The issue occurs when Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data from an action or rule name, resulting in an infinite loop that consumes all available memory and disk space.

Recommendations: For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue. As a temporary workaround, consider setting the locale to utf-8 to prevent the infinite loop. Additionally, restrict logging of Unicode data from action or rule names until the update is applied.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2021-28667

GHSA-39MJ-FPG2-3JRG

Affected Products

Python

Stackstorm

References · 8

• https://stackstorm.com/2021/03/10/stackstorm-v3-4-1-security-fix · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-39mj-fpg2-3jrg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28667 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28667 · Vendor Advisory
• https://github.com/StackStorm/st2 · Note
• https://t.me/cibsecurity/25076 · Telegram Post
• https://t.me/cvenotify/11510 · Telegram Post
• https://t.me/cvenotify/11942 · Telegram Post