CVE-2021-3716

Name	CVE-2021-3716
Description	A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nbdkit (PTS)	bookworm	1.32.5-1	fixed
	trixie	1.42.3-1	fixed
	forky, sid	1.48.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
nbdkit	source	stretch	(not affected)
nbdkit	source	buster	(not affected)
nbdkit	source	(unstable)	1.26.5-1

Notes

[bullseye] - nbdkit <no-dsa> (Minor issue)
[buster] - nbdkit <not-affected> (Vulnerable code introduced later)
[stretch] - nbdkit <not-affected> (Vulnerable code introduced later)
Introduced by: https://github.com/libguestfs/nbdkit/commit/eaa4c6e9a2c4bdb71aefdd4b1d865e7a9af606a8 (v1.11.8)
https://listman.redhat.com/archives/libguestfs/2021-August/msg00077.html