attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected products
Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 7
Classified as
CWE-20 (Improper Input Validation)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 7
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.