PT-2021-3195 · Ssri+5 · Ssri+5

Aveek Biswas · Published 2021-03-12 · Updated 2024-06-15 · CVE-2021-27290

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ssri versions 5.2.2 through 8.0.0

Description The issue is related to the processing of SRIs using a regular expression, which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Recommendations For versions 5.2.2 through 8.0.0, update to version 8.0.1 to resolve the issue. As a temporary workaround, consider disabling the strict option until a patch is available. Restrict the use of SRIs to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2021:3073

ALSA-2021:3074

BDU:2021-02890

CESA-2021_3073

CESA-2021_3074

CVE-2021-27290

GHSA-VX3P-948G-6VHQ

MGASA-2021-0372

OESA-2022-1620

OPENSUSE-SU-2021:1059-1

OPENSUSE-SU-2021:1060-1

OPENSUSE-SU-2021:1061-1

OPENSUSE-SU-2021:1113-1

OPENSUSE-SU-2021:2327-1

OPENSUSE-SU-2021:2353-1

OPENSUSE-SU-2021:2354-1

OPENSUSE-SU-2021:2618-1

OPENSUSE-SU-2021_1059-1

OPENSUSE-SU-2021_1060-1

OPENSUSE-SU-2021_1061-1

OPENSUSE-SU-2021_1113-1

OPENSUSE-SU-2021_2327-1

OPENSUSE-SU-2021_2353-1

OPENSUSE-SU-2021_2354-1

OPENSUSE-SU-2021_2618-1

OPENSUSE-SU-2024:11096-1

RHSA-2021:2931

RHSA-2021:2932

RHSA-2021:3073

RHSA-2021:3074

RHSA-2021:3638

RHSA-2021:3639

RHSA-2021_3073

RHSA-2021_3074

RLSA-2021:3073

RLSA-2021:3074

SUSE-SU-2021:2319-1

SUSE-SU-2021:2323-1

SUSE-SU-2021:2326-1

SUSE-SU-2021:2327-1

SUSE-SU-2021:2353-1

SUSE-SU-2021:2354-1

SUSE-SU-2021:2618-1

SUSE-SU-2021:2620-1

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Ssri

References · 133

• 🔥 https://github.com/riptl/cve-2021-3449 · Exploit
• 🔥 https://github.com/terorie/cve-2021-3449 · Exploit
• 🔥 https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf · Exploit
• 🔥 https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf · Exploit
• https://errata.rockylinux.org/RLSA-2021:3074 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:2354-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1113-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/686780 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2326-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-27290 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22960 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2354-1 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21824 · Security Note
• https://ubuntu.com/security/CVE-2021-27290 · Vendor Advisory