CVE-2021-22883

描述

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

如何修補 CVE-2021-22883

要修補 CVE-2021-22883,請將受影響套件升級到下列已修補版本。

• —升級至 12.21.0-r0 或更新版本
• —升級至 10.24.0 或更新版本
• —升級至 10.24.0 或更新版本
• —升級至 12.21.0~dfsg-1 或更新版本
• —升級至 10.24.0~dfsg-1~deb10u1 或更新版本

CVE-2021-22883 正在被利用嗎?

可能 — EPSS 為 77.4%,屬於高被利用機率區間,建議優先修補。

受影響套件(5)

• from 0, < 12.21.0-r0
• >= 10.0.0, < 10.24.0, >= 12.0.0, < 12.21.0, >= 14.0.0, < 14.16.0, >= 15.0.0, < 15.10.0
• >= 10.0.0, < 10.24.0, >= 12.0.0, < 12.21.0, >= 14.0.0, < 14.16.0, >= 15.0.0, < 15.10.0
• from 0, < 12.21.0~dfsg-1
• from 0, < 10.24.0~dfsg-1~deb10u1

CVSS 分數

參考連結(13)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-22883
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-22883
• WEBcert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• WEBhackerone.com/reports/1043360