CVEvulnerability

CVE-2021-3716

3.1 LOW Published 2022-03-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.1 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:N/A:P
Weaknesses
CWE-924

Description

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.

Affected configurations

• nbdkit project nbdkit (>= 1.11.8 < 1.24.6) • nbdkit project nbdkit (>= 1.25.1 < 1.26.5) • nbdkit project nbdkit (>= 1.27.1 < 1.27.6) • redhat enterprise linux 8.0

Related

Weakness · CWE (1)

  • CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel weakness

References