Memory Leak Affecting pki-symkey package, versions <0:10.12.0-2.module+el8.6.0+14115+8b467244


Severity

Recommended
medium

Based on CentOS security rating.

Threat Intelligence

EPSS
0.41% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Memory Leak vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS8-PKISYMKEY-2822685
  • published10 Feb 2022
  • disclosed9 Feb 2022

Introduced: 9 Feb 2022

CVE-2021-4213  (opens in a new tab)
CWE-401  (opens in a new tab)

How to fix?

Upgrade Centos:8 pki-symkey to version 0:10.12.0-2.module+el8.6.0+14115+8b467244 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pki-symkey package and not the pki-symkey package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

CVSS Scores

version 3.1