CVE Vulnerability

CVE-2021-21369

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.

4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q Third Party Advisory
https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022 Patch Third Party Advisory
https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 Release Notes Third Party Advisory
https://github.com/hyperledger/besu/pull/1144 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:linuxfoundation:besu:*:*:*:*:*:*:*:*
Information

Published : 2021-03-09 06:15

Updated : 2021-03-16 05:25

NVD link : CVE-2021-21369

Mitre link : CVE-2021-21369

Products Affected
No products.
CWE
CWE-400