Vulnerability CVE-2021-30468 - CERT Civis.Net

Vulnerability Name:

CVE-2021-30468 (CCN-203830)

Assigned:

2021-06-16

Published:

2021-06-16

Updated:

2022-04-25

Summary:

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2021-30468

Source: CONFIRM
Type: Vendor Advisory
N/A

Source: MLIST
Type: Mailing List, Third Party Advisory
[oss-security] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Source: CCN
Type: Apache Web site
Apache CXF

Source: XF
Type: UNKNOWN
apache-cve202130468-dos(203830)

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210705 [jira] [Created] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210913 [jira] [Reopened] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: MLIST
Type: Mailing List, Vendor Advisory
[announce] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Source: MLIST
Type: Mailing List, Vendor Advisory
[cxf-dev] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Source: MLIST
Type: Mailing List, Vendor Advisory
[cxf-users] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210913 [jira] [Updated] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210913 [jira] [Commented] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210901 [jira] [Resolved] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210705 [jira] [Updated] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: MLIST
Type: Mailing List, Vendor Advisory
[tomee-commits] 20210901 [jira] [Commented] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF

Source: CCN
Type: oss-sec Mailing List, Wed, 16 Jun 2021 10:49:44 +0100
CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210917-0002/

Source: CCN
Type: IBM Security Bulletin 6483303 (Tivoli Application Dependency Discovery Manager)
Apache CXF vulnerability identified in IBM Tivoli Application Dependency Discovery Manager (CVE-2021-30468)

Source: CCN
Type: IBM Security Bulletin 6520492 (QRadar SIEM)
Apache CXF as used by IBM QRadar SIEM is vulnerable to denial of service (DOS) (CVE-2021-30468)

Source: CCN
Type: IBM Security Bulletin 6550790 (Tivoli Network Manager IP Edition)
Tivoli Network Manager IP Edition is vulnerable to a denial of service vulnerability (CVE-2021-30468)

Source: CCN
Type: IBM Security Bulletin 6616299 (TRIRIGA Application Platform)
BM TRIRIGA Application Platform discloses CVE-2021-30468

Source: CCN
Type: IBM Security Bulletin 6831647 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 7005971 (Security Verify Governance)
IBM Security Verify Governance uses components with known vulnerabilities (CVE-2021-22696, CVE-2021-30468, CVE-2020-1954)

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Source: CCN
Type: Oracle CPUOct2021
Oracle Critical Patch Update Advisory - October 2021

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerable Configuration:

Configuration 1:

cpe:/a:apache:cxf:*:*:*:*:*:*:*:* (Version < 3.3.11)

OR cpe:/a:apache:cxf:*:*:*:*:*:*:*:* (Version >= 3.4.0 and < 3.4.4)

OR cpe:/a:apache:tomee:8.0.6:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*

OR cpe:/a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*

OR cpe:/a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*

OR cpe:/a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*

OR cpe:/a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:*

OR cpe:/o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apache:cxf:3.3.10:*:*:*:*:*:*:*

OR cpe:/a:apache:cxf:3.4.3:*:*:*:*:*:*:*

AND

cpe:/a:ibm:tririga_application_platform:2.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_network_manager:3.9:*:ip:*:*:*:*:*

OR cpe:/a:ibm:tivoli_network_manager:4.1.1:*:ip:*:*:*:*:*

OR cpe:/a:oracle:business_intelligence:12.2.1.3.0::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:10.5:*:*:*:*:*:*:*

OR cpe:/a:oracle:business_intelligence:12.2.1.4.0::~~enterprise~~~:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:10.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:tivoli_application_dependency_discovery_manager:7.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:11.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:11.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:11.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

Denotes that component is vulnerable