CVE-2021-22553: Heap Memory exhaustion in Gerrit
Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2021-22553?
CVE-2021-22553 has a medium severity rating due to its potential for heap memory exhaustion on Gerrit servers.
How do I fix CVE-2021-22553?
To fix CVE-2021-22553, upgrade Gerrit to versions higher than 2.15.22 or the specified ranges for subsequent versions.
What does CVE-2021-22553 affect?
CVE-2021-22553 affects multiple versions of Gerrit, specifically versions prior to 2.15.22 and some versions within specified ranges up to 3.3.2.
What conditions lead to the vulnerability described in CVE-2021-22553?
The vulnerability occurs when multiple git operations are executed through Jetty without a session expiry, leading to memory exhaustion.
Is there a workaround for CVE-2021-22553 if I cannot upgrade Gerrit?
A temporary workaround for CVE-2021-22553 includes limiting the number of concurrent git operations to prevent session buildup.