Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.
References
Link | Resource |
---|---|
https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 | Release Notes Third Party Advisory |
https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022 | Patch Third Party Advisory |
https://github.com/hyperledger/besu/pull/1144 | Patch Third Party Advisory |
https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q | Third Party Advisory |
Configurations
History
16 Mar 2021, 17:25
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
CPE | cpe:2.3:a:linuxfoundation:besu:*:*:*:*:*:*:*:* | |
References | (CONFIRM) https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q - Third Party Advisory | |
References | (MISC) https://github.com/hyperledger/besu/pull/1144 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022 - Patch, Third Party Advisory | |
References | (MISC) https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 - Release Notes, Third Party Advisory |
09 Mar 2021, 19:15
Type | Values Removed | Values Added |
---|---|---|
Summary | Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1. |
09 Mar 2021, 18:39
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-03-09 18:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21369
Mitre link : CVE-2021-21369
CVE.ORG link : CVE-2021-21369
JSON object : View
Products Affected
linuxfoundation
- besu
CWE
CWE-400
Uncontrolled Resource Consumption