Vulnerability Description
Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file
CVSS Score
5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wireshark | Wireshark | >= 3.2.0, <= 3.2.12 |
| Fedoraproject | Fedora | 33 |
| Oracle | Zfs Storage Appliance Kit | 8.8 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22207.jsonThird Party Advisory
- https://gitlab.com/wireshark/wireshark/-/issues/17331ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00015.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202107-21Third Party Advisory
- https://www.debian.org/security/2021/dsa-5019Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- https://www.wireshark.org/security/wnpa-sec-2021-04.htmlVendor Advisory
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22207.jsonThird Party Advisory
- https://gitlab.com/wireshark/wireshark/-/issues/17331ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00015.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202107-21Third Party Advisory
FAQ
What is CVE-2021-22207?
CVE-2021-22207 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of service via packet injection or crafted capture file
How severe is CVE-2021-22207?
CVE-2021-22207 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-22207?
Check the references section above for vendor advisories and patch information. Affected products include: Wireshark Wireshark, Fedoraproject Fedora, Oracle Zfs Storage Appliance Kit, Debian Debian Linux.