5.3

CVE-2021-20201: redhat enterprise_linux Uncontrolled Resource Consumption

CVSS: 5.3v3.1MediumModified
AliasesALPINE-CVE-2021-20201MGASA-2021-0405SUSE-SU-2021:1906-1
Published 28-05-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-20201 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in redhat enterprise_linux. EPSS estimates a 2.70% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (NVD)
EPSS score
2.70%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
SUSE-SU-2021:14744-1SUSE-SU-2021:1901-1SUSE-SU-2021:1902-1SUSE-SU-2021:1956-1

Timeline

  1. 28-05-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

2.70%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

0.00 pp

From 2.70% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.70%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (blog.qualys.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse17 products
  • spice&distro=HPE Helion OpenStack 8< 0.12.8-18.1
  • spice&distro=SUSE Linux Enterprise Micro 5.0< 0.14.2-3.6.1
  • spice&distro=SUSE Linux Enterprise Micro 5.2< 0.14.3-150300.3.3.1
  • spice&distro=SUSE Linux Enterprise Module for Server Applications 15 SP2< 0.14.2-3.6.1
  • spice&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 0.14.3-150300.3.3.1
Redhat6 products
  • enterprise_linuxEOL6.0 | 7.0 | 8.0
  • spice< 0:0.14.3-4.el8
  • spice-debugsource< 0:0.14.3-4.el8
  • spice-server< 0:0.14.3-4.el8
  • spice-server-debuginfo< 0:0.14.3-4.el8
Opensuse5 products
  • spice-gtk&distro=openSUSE Tumbleweed< 0.41-3.1
  • spice&distro=openSUSE Leap 15.2< 0.14.2-lp152.2.6.1
  • spice&distro=openSUSE Leap 15.3< 0.14.3-150300.3.3.1
  • spice&distro=openSUSE Leap Micro 5.2< 0.14.3-150300.3.3.1
  • spice&distro=openSUSE Tumbleweed< 0.15.2-2.1
Alpine1 product
  • spice< 0.14.2-r1 | < 0.14.2-r2 | < 0.14.3-r1
Debian1 product
  • spice< 0.14.3-2.1
Mageia1 product
  • spice< 0.14.3-3.1.mga8
Spice_project1 product
Ubuntu1 product
  • spiceAll versions (No fix recorded)

8 vendors · 33 products

References

23 links
Show all 23 references