PT-2022-11544 · Jss+5 · Jss+5

Cedric Buissart · Published 2022-05-10 · Updated 2024-03-01 · CVE-2021-4213

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JSS (affected versions not specified)

Description A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2022:1851

CESA-2022_1851

CVE-2021-4213

OESA-2024-1208

OESA-2024-1220

OESA-2024-1221

RHSA-2022:1851

RHSA-2022_1851

RHSA-2024:0774

RLSA-2022:1851

Affected Products

Almalinux

Centos

Debian

Jss

Red Hat

Rocky Linux

References · 32

• https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2 · Patch
• https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2042900 · Patch
• https://linux.oracle.com/errata/ELSA-2022-1851.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:1851 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4213 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-4213 · Security Note
• https://ubuntu.com/security/CVE-2021-4213 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:1851 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4213 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1221 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1208 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-1851.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-4213 · Vendor Advisory