// For flags

CVE-2021-41119

DoS vulnerabiliity in wire-server json parser

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.

Wire-server es el servidor del sistema para los servicios de back-end de wire. Las versiones anteriores a v2022-03-01, están sujetas a un ataque de denegación de servicio por medio de un objeto diseñado que causa una colisión de hash. Esta colisión hace que el servidor emplee al menos un tiempo cuadrático en analizarlo, lo que puede conllevar a una denegación de servicio para un servidor muy usado. El problema ha sido corregido en wire-server 01-03-2022 y ya está implementado en todos los servicios administrados de Wire. Las instancias locales de wire-server deben actualizarse a versión 01-03-2022, para que sus backends ya no estén afectados. No se presentan medidas de mitigación conocidas para este problema

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-15 CVE Reserved
  • 2022-04-13 CVE Published
  • 2023-11-04 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-400: Uncontrolled Resource Consumption
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wire
Search vendor "Wire"
 Wire-server
Search vendor "Wire" for product "Wire-server"
 < 2022-03-01
Search vendor "Wire" for product "Wire-server" and version " < 2022-03-01"
-
Affected