CVE-2021-43045

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.openwall.com/lists/oss-security/2022/01/06/8	Mailing List Third Party Advisory
https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/01/06/8	Mailing List Third Party Advisory
https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:avro:*:*:*:*:*:.net:*:*

History

No history.

Information

Published : 2022-01-06 18:15

Updated : 2024-11-21 06:28

NVD link : CVE-2021-43045

Mitre link : CVE-2021-43045

CVE.ORG link : CVE-2021-43045

JSON object : View

Products Affected

apache

avro

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2021-43045", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-01-06T18:15:07.863", "references": [{"url": "http://www.openwall.com/lists/oss-security/2022/01/06/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2022/01/06/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd", "tags": ["Mailing List", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-770"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue."}, {"lang": "es", "value": "Una vulnerabilidad en el SDK .NET de Apache Avro permite a un atacante asignar recursos excesivos, causando potencialmente un ataque de denegaci\u00f3n de servicio. Este problema afecta a las aplicaciones .NET que usan Apache Avro versiones 1.10.2 y anteriores. Los usuarios deben actualizar a versi\u00f3n 1.11.0, que aborda este problema."}], "lastModified": "2024-11-21T06:28:35.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:avro:*:*:*:*:*:.net:*:*", "vulnerable": true, "matchCriteriaId": "E466F509-ED2A-41A6-A6C8-E3124EAED4F4", "versionEndExcluding": "1.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}