CVE-2021-21369: 
NixOS vulnerability analysis and mitigation

Hyperledger Besu, an open-source MainNet compatible Ethereum client written in Java, was found to contain a denial-of-service vulnerability (CVE-2021-21369) in versions before 1.5.1. The vulnerability was discovered in the HTTP JSON-RPC API service authentication mechanism and was disclosed in January 2021 (MITRE CVE, GitHub Advisory).

The vulnerability exists in the authentication system of the HTTP JSON-RPC API service. When username and password authentication is enabled, users must obtain a JSON web token (JWT) through the login endpoint before accessing API endpoints. The password validation process occurs on the main vertx event loop and is computationally intensive. This implementation flaw allows a malicious actor to overload the login endpoint with invalid requests using a known valid username but incorrect passwords (GitHub Advisory).

A successful exploitation of this vulnerability could result in a denial-of-service condition where the processing of legitimate requests fails due to the system being overwhelmed by invalid login attempts. The impact is limited to the HTTP JSON-RPC API service and potentially the websocket service. The attack requires knowledge of a valid username to be executed (GitHub Advisory).

The vulnerability can be exploited remotely by an attacker who has knowledge of a valid username in the system. The attack vector involves sending multiple invalid login requests to the authentication endpoint. The severity is considered Low due to the requirement of having a valid username and the limited scope of impact (GitHub Advisory).

The vulnerability was fixed in Hyperledger Besu version 1.5.1. Users running affected versions should upgrade to version 1.5.1 or later to mitigate this security issue (MITRE CVE).