Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21607

CVE-2021-21607: Excessive memory allocation in graph URLs leads to denial of service in Jenkins

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21607
GHSA ID
GHSA-cxqw-vjcr-gp5g
EPSS Score
0.49559%
CWE
CWE-770
Published
5/24/2022
Updated
12/14/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.main:jenkins-coremaven<= 2.263.12.263.2
org.jenkins-ci.main:jenkins-coremaven>= 2.264, <= 2.2742.275

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unvalidated graph dimensions in graph rendering. The pre-patch code in Graph.java's render method directly parsed 'w' and 'h' parameters from the request (via Integer.parseInt(w)/Integer.parseInt(h)) and passed them to JFreeChart's createBufferedImage. This allowed attackers to specify arbitrary large values for graph dimensions. The commit added MAX_AREA validation and safeDimension checks, confirming the vulnerability was in the original rendering path that lacked these protections.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins r*n**rs s*v*r*l *i***r*nt *r*p*s *or ***tur*s lik* ***nt *n* l***l us*** st*tisti*s, m*mory us***, or v*rious plu*in-provi*** st*tisti*s. J*nkins *.*** *n* **rli*r, LTS *.***.* *n* **rli*r *o*s not limit t** *r*p* siz* provi*** *s qu*ry p*r*

Reasoning

T** vuln*r**ility st*ms *rom unv*li**t** *r*p* *im*nsions in *r*p* r*n**rin*. T** pr*-p*t** *o** in *r*p*.j*v*'s r*n**r m*t*o* *ir**tly p*rs** 'w' *n* '*' p*r*m*t*rs *rom t** r*qu*st (vi* Int***r.p*rs*Int(w)/Int***r.p*rs*Int(*)) *n* p*ss** t**m to J*