CVE-2021-22883
High
Description
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
SeverityHigh
CVSS7.5
Exploit probability100. percentile77.4%
Product
Nodejs Node.js
PublishedMar 3, 2021
First seenMar 3, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- nodejs node.js10.24.0, 12.21.0, 14.16.0, 15.10.0 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.0 or later
- oracle nosql_database20.3 or later
- siemens sinec_infrastructure_network_services1.0.1.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | 10.0.0 ≤ v < 10.24.0, 12.0.0 ≤ v < 12.21.0, 14.0.0 ≤ v < 14.16.0, 15.0.0 ≤ v < 15.10.0 | 10.24.0, 12.21.0, 14.16.0, 15.10.0 |
| fedoraproject fedora | 32, 33, 34 | — |
| netapp e-series_performance_analyzer | No range specified | — |
| oracle graalvm | 19.3.5, 20.3.1.2, 21.0.0.2 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.0 | 9.2.6.0 |
| oracle mysql_cluster | v ≤ 8.0.25 | — |
| oracle nosql_database | v < 20.3 | 20.3 |
| oracle peoplesoft_enterprise_peopletools | 8.58, 8.59 | — |
| siemens sinec_infrastructure_network_services | v < 1.0.1.1 | 1.0.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.