{"containers": {"cna": {"affected": [{"product": "wire-server", "vendor": "wireapp", "versions": [{"status": "affected", "version": "< v2022-03-01"}]}], "descriptions": [{"lang": "en", "value": "Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-13T18:25:11.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r"}, {"tags": ["x_refsource_MISC"], "url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"}], "source": {"advisory": "GHSA-phxv-pffh-fq2r", "discovery": "UNKNOWN"}, "title": "DoS vulnerabiliity in wire-server json parser", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-41119", "STATE": "PUBLIC", "TITLE": "DoS vulnerabiliity in wire-server json parser"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "wire-server", "version": {"version_data": [{"version_value": "< v2022-03-01"}]}}]}, "vendor_name": "wireapp"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400: Uncontrolled Resource Consumption"}]}]}, "references": {"reference_data": [{"name": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r", "refsource": "CONFIRM", "url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r"}, {"name": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability", "refsource": "MISC", "url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"}]}, "source": {"advisory": "GHSA-phxv-pffh-fq2r", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:59:31.626Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-22T15:41:32.801891Z", "id": "CVE-2021-41119", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T18:16:06.159Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-41119", "datePublished": "2022-04-13T18:25:11.000Z", "dateReserved": "2021-09-15T00:00:00.000Z", "dateUpdated": "2025-04-22T18:16:06.159Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:59:31.626Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-41119", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-22T15:41:32.801891Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T15:41:34.888Z"}}], "cna": {"title": "DoS vulnerabiliity in wire-server json parser", "source": {"advisory": "GHSA-phxv-pffh-fq2r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "wireapp", "product": "wire-server", "versions": [{"status": "affected", "version": "< v2022-03-01"}]}], "references": [{"url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-04-13T18:25:11.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, "source": {"advisory": "GHSA-phxv-pffh-fq2r", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< v2022-03-01"}]}, "product_name": "wire-server"}]}, "vendor_name": "wireapp"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r", "name": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r", "refsource": "CONFIRM"}, {"url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability", "name": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400: Uncontrolled Resource Consumption"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-41119", "STATE": "PUBLIC", "TITLE": "DoS vulnerabiliity in wire-server json parser", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2021-41119", "state": "PUBLISHED", "dateUpdated": "2025-04-22T18:16:06.159Z", "dateReserved": "2021-09-15T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-04-13T18:25:11.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wire:wire-server:*:*:*:*:*:*:*:*", "matchCriteriaId": "90144601-EF7E-4BEB-B24F-5ECB072B585D", "versionEndExcluding": "2022-03-01", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue."}, {"lang": "es", "value": "Wire-server es el servidor del sistema para los servicios de back-end de wire. Las versiones anteriores a v2022-03-01, est\u00e1n sujetas a un ataque de denegaci\u00f3n de servicio por medio de un objeto dise\u00f1ado que causa una colisi\u00f3n de hash. Esta colisi\u00f3n hace que el servidor emplee al menos un tiempo cuadr\u00e1tico en analizarlo, lo que puede conllevar a una denegaci\u00f3n de servicio para un servidor muy usado. El problema ha sido corregido en wire-server 01-03-2022 y ya est\u00e1 implementado en todos los servicios administrados de Wire. Las instancias locales de wire-server deben actualizarse a versi\u00f3n 01-03-2022, para que sus backends ya no est\u00e9n afectados. No se presentan medidas de mitigaci\u00f3n conocidas para este problema"}], "id": "CVE-2021-41119", "lastModified": "2024-11-21T06:25:30.633", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-13T19:15:08.990", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://cs-syd.eu/posts/2021-09-11-json-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}