Azure Linux 3.0 Security Update: rpm-ostree (CVE-2021-32714)

critical Nessus Plugin ID 295543

Language:

Synopsis

The remote Azure Linux host is missing one or more security updates.

Description

The version of rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-32714 advisory.

- hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in request smuggling or desync attacks. The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One May reject requests manually that contain a `Transfer- Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers. (CVE-2021-32714)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 295543

File Name: azure_linux_CVE-2021-32714.nasl

Version: 1.1

Type: local

Family: Azure Linux Local Security Checks

Published: 1/22/2026

Updated: 1/22/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2021-32714

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:microsoft:azure_linux:rpm-ostree-devel, x-cpe:/o:microsoft:azure_linux, p-cpe:/a:microsoft:azure_linux:rpm-ostree, p-cpe:/a:microsoft:azure_linux:rpm-ostree-debuginfo

Required KB Items: Host/local_checks_enabled, Host/AzureLinux/release, Host/AzureLinux/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/10/2024

Vulnerability Publication Date: 7/7/2021

Reference Information

CVE: CVE-2021-32714

Detections

Analytics