CVE-2021-22173: 
Wireshark vulnerability analysis and mitigation

Memory leak vulnerability (CVE-2021-22173) was discovered in the USB HID dissector component of Wireshark versions 3.4.0 to 3.4.2. The vulnerability was disclosed on January 29, 2021, and affects the network traffic analyzer's ability to process USB HID packets (Wireshark Advisory).

The vulnerability exists in the USB HID (Human Interface Device) dissector component of Wireshark. When processing USB HID packets, the dissector could leak memory, leading to excessive resource consumption. The vulnerability has a CVSS v3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and affecting only availability (Oracle Advisory).

The vulnerability allows denial of service attacks through either packet injection on a network or by convincing a user to open a crafted capture file. When exploited, it can cause Wireshark to consume excessive CPU resources (Wireshark Advisory).

The vulnerability can be exploited remotely without authentication by either injecting malformed packets onto the network or by creating a specially crafted packet capture file that, when opened by Wireshark, triggers the memory leak (Debian Security).

The vulnerability was fixed in Wireshark version 3.4.3. Users are advised to upgrade to this version or later to mitigate the risk. No temporary workarounds were provided in the security advisories (Wireshark Advisory).