Vulnerability · Published Feb 10, 2021 · Assigned by GitHub_M

CVE-2021-21296Denial-of-service in Fleet

Low 2.7

In plain English

A low-severity uncontrolled resource consumption in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)2.0%top 18.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.

Affected products (as reported)

Vendor	Product	Versions
fleetdm	fleet	< 3.7.0

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45 x_refsource_CONFIRM
https://www.npmjs.com/package/fleetctl x_refsource_MISC
https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40 x_refsource_MISC