CVE-2021-3716 — Improper Enforcement of Message Integrity During Transmission in a Communication Channel in Project Nbdkit
Severity
3.1LOWNVD
EPSS
0.1%
top 75.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 2
Latest updateMar 8
Description
A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 1.6 | Impact: 1.4
Affected Packages3 packages
Also affects: Enterprise Linux 8.0
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-3vpg-mwgf-4jvj: A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary↗2022-03-04
OSV▶
CVE-2021-3716: A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary↗2022-03-02
CVEList▶
CVE-2021-3716: A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary↗2022-03-02
📋Vendor Advisories
3Microsoft▶
A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY befo↗2022-03-08
Debian▶
CVE-2021-3716: nbdkit - A flaw was found in nbdkit due to to improperly caching plaintext state across t...↗2021