NVD Vulnerability Detail

CVE-2021-4213

Summary	A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
Publication Date	Aug. 25, 2022, 1:15 a.m.
Registration Date	Aug. 25, 2022, 10 a.m.
Last Update	Nov. 21, 2024, 3:37 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:dogtagpki:network_security_services_for_java::::::::	5.0.0			5.1.0
cpe:2.3:a:dogtagpki:network_security_services_for_java::::::::				4.9.3

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*

Related information, measures and tools

No	URL	タグ
1	https://access.redhat.com/security/cve/CVE-2021-4213	Third Party Advisory
2	https://access.redhat.com/security/cve/CVE-2021-4213	Third Party Advisory
3	https://bugzilla.redhat.com/show_bug.cgi?id=2042900	Issue Tracking Patch Third Party Advisory
4	https://bugzilla.redhat.com/show_bug.cgi?id=2042900	Issue Tracking Patch Third Party Advisory
5	https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2	Patch Third Party Advisory
6	https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2	Patch Third Party Advisory
7	https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448	Patch Third Party Advisory
8	https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448	Patch Third Party Advisory
9	https://security-tracker.debian.org/tracker/CVE-2021-4213	Third Party Advisory
10	https://security-tracker.debian.org/tracker/CVE-2021-4213	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-401	有効期限後のメモリの解放の欠如	https://cwe.mitre.org/data/definitions/401.html

JVN Vulnerability Information

Dogtag PKI の network security services for java 他複数ベンダの製品における有効期限後のメモリの解放の欠如に関する脆弱性

Title	Dogtag PKI の network security services for java 他複数ベンダの製品における有効期限後のメモリの解放の欠如に関する脆弱性
Summary	Dogtag PKI の network security services for java 他複数ベンダの製品には、有効期限後のメモリの解放の欠如に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 24, 2022, midnight
Registration Date	Sept. 28, 2023, 5:10 p.m.
Last Update	Sept. 28, 2023, 5:10 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux 8.0

Debian

Debian GNU/Linux 10.0

Debian GNU/Linux 11.0

Dogtag PKI

network security services for java 4.9.3 未満

network security services for java 5.0.0 以上 5.1.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-4213	https://www.cve.org/CVERecord?id=CVE-2021-4213
National Vulnerability Database (NVD)
2	CVE-2021-4213	https://nvd.nist.gov/vuln/detail/CVE-2021-4213

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-401	https://cwe.mitre.org/data/definitions/401.html

その他

No	Name	URL
関連文書
1	access.redhat.com (CVE-2021-4213)	https://access.redhat.com/security/cve/CVE-2021-4213
2	bugzilla.redhat.com (2042900)	https://bugzilla.redhat.com/show_bug.cgi?id=2042900
3	github.com (3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2)	https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2
4	github.com (5922560a78d0dee61af8a33cc9cfbf4cfa291448)	https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448
5	security-tracker.debian.org (CVE-2021-4213)	https://security-tracker.debian.org/tracker/CVE-2021-4213

Change Log

No	Changed Details	Date of change
1	[2023年09月28日] 掲載	Sept. 28, 2023, 5:10 p.m.