UBUNTU-CVE-2021-41119

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-41119

    UBUNTU-CVE-2021-41119

    Published: 13 Apr 2022Last Modified: 22 Apr 2026
    Upstream:
    CVE-2021-41119

    Summary:

    Details: Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.

    References: https://ubuntu.com/security/CVE-2021-41119, https://cs-syd.eu/posts/2021-09-11-json-vulnerability, https://github.com/haskell/aeson/issues/864, https://hackage.haskell.org/package/aeson-2.0.1.0, https://github.com/haskell/aeson/commit/582a844d8028f62e409048a4caae187b27e8e697, https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r, https://www.cve.org/CVERecord?id=CVE-2021-41119

    Affected packages

    Package

    Name: haskell-aeson

    Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.8.0.2-3
    0.8.0.2-5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-41119 | CVE-DB