Candidate: CVE-2021-41119
PublicDate: 2022-04-13 19:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41119
 https://cs-syd.eu/posts/2021-09-11-json-vulnerability
 https://github.com/haskell/aeson/issues/864
 https://hackage.haskell.org/package/aeson-2.0.1.0
 https://github.com/haskell/aeson/commit/582a844d8028f62e409048a4caae187b27e8e697 (v2.0.1.0)
 https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r
Description:
 Wire-server is the system server for the wire back-end services. Releases
 prior to v2022-03-01 are subject to a denial of service attack via a
 crafted object causing a hash collision. This collision causes the server
 to spend at least quadratic time parsing it which can lead to a denial of
 service for a heavily used server. The issue has been fixed in wire-server
 2022-03-01 and is already deployed on all Wire managed services. On premise
 instances of wire-server need to be updated to 2022-03-01, so that their
 backends are no longer affected. There are no known workarounds for this
 issue.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009678
Priority: medium 
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]


Patches_haskell-aeson:
 upstream: https://github.com/haskell/aeson/commit/582a844d8028f62e409048a4caae187b27e8e697
upstream_haskell-aeson: released (2.0.1.0) 
trusty_haskell-aeson: ignored (out of standard support, was needed)
xenial_haskell-aeson: ignored (out of standard support, was needed)
bionic_haskell-aeson: needed
focal_haskell-aeson: needed
impish_haskell-aeson: needed
jammy_haskell-aeson: needed
devel_haskell-aeson: needed