Medium severity · published May 24, 2022
CVE-2021-3597
A flaw was found in undertow
5.9
CVSS
1.2%
EPSS
No
On KEV
Description
A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
FU
Fuse · Redhat
1.0 · source: NVD
JE
Jboss Enterprise Application Platform · Redhat
7.3; 7.4 · source: NVD
OI
Oncommand Insight · Netapp
All versions, or not specified · source: NVD
OW
Oncommand Workflow Automation · Netapp
All versions, or not specified · source: NVD
OA
Openshift Application Runtimes · Redhat
All versions, or not specified · source: NVD
SS
Single Sign-on · Redhat
All versions, or not specified · source: NVD
UN
Undertow · Redhat
before 2.0.35; 2.2.0 before 2.2.6; 2.0.35; 2.0.36; 2.0.39; 2.2.6; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3597
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1970930
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220804-0003/
More from Active IQ Unified Manager
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
8.8
CVE-2023-41993
Apple Multiple Products WebKit Code Execution Vulnerability
8.8
CVE-2023-4863
Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
8.1
CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…
8.1
CVE-2017-12617
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g