Buffer overflow in Apache Plc4x
CVE-2021-43083
Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.019 (79.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 79.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.019 · newest: 0.019 · change: 0.000
Affected products
- Apache Plc4x
- Apache Software Foundation Plc4x — versions PLC4C
Weakness classification (CWE)
References
- lists.apache.org/thread/jxx6qc84z60xbbhn6vp2s5qf09psrtc7 (Vendor Advisory)
- www.openwall.com/lists/oss-security/2021/12/20/2 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-43083?
- CVE-2021-43083 is a high-severity vulnerability in Apache Plc4x, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2021-12-19.
- How severe is CVE-2021-43083?
- High severity. CVSS v3 base score is 8.8 out of 10.