Vulnerability Database

296,733

Total vulnerabilities in the database

CVE-2021-3716

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.

  • Published: Mar 3, 2022
  • Updated: Apr 14, 2023
  • CVE: CVE-2021-3716
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 3.1
  • AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:N/I:N/A:P

CWEs:

Software From Fixed in
nbdkit_project / nbdkit 1.27.1 1.27.6
nbdkit_project / nbdkit 1.25.1 1.26.5
nbdkit_project / nbdkit 1.11.8 1.24.6
redhat / enterprise_linux 8.0 8.0.x