high
7.5
CWE
400
Advisory Published
Advisory Published
CVE Published
Updated

CVE-2021-37136

First published: Thu Sep 09 2021(Updated: )

### Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack ### Workarounds No workarounds other than not using the `Bzip2Decoder` ### References Relevant code areas: https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305

Credit: reefs@jfrog.com reefs@jfrog.com

Affected SoftwareAffected VersionHow to fix
maven/io.netty:netty<4.0.0
maven/org.jboss.netty:netty<4.0.0
maven/io.netty:netty-codec<4.1.68.Final
4.1.68.Final
redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el8ea
0:4.1.72-4.Final_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.72-4.Final_redhat_00001.1.el7ea
0:4.1.72-4.Final_redhat_00001.1.el7ea
redhat/candlepin<0:4.1.15-1.el8
0:4.1.15-1.el8
redhat/netty-codec<4.1.68.
4.1.68.
Netty Netty<4.1.68
Quarkus Quarkus<2.2.4
Oracle Banking Apis>=18.1<=18.3
Oracle Banking Apis=19.1
Oracle Banking Apis=19.2
Oracle Banking Apis=20.1
Oracle Banking Apis=21.1
Oracle Banking Digital Experience=18.1
Oracle Banking Digital Experience=18.2
Oracle Banking Digital Experience=18.3
Oracle Banking Digital Experience=19.1
Oracle Banking Digital Experience=19.2
Oracle Banking Digital Experience=20.1
Oracle Banking Digital Experience=21.1
Oracle Coherence=12.2.1.4.0
Oracle Coherence=14.1.1.0.0
Oracle Commerce Guided Search=11.3.2
Oracle Communications Brm - Elastic Charging Engine<12.0.0.4.6
Oracle Communications Brm - Elastic Charging Engine=12-0.0.5.0
Oracle Communications Cloud Native Core Binding Support Function=1.10.0
Oracle Communications Cloud Native Core Binding Support Function=1.11.0
Oracle Communications Cloud Native Core Network Slice Selection Function=1.8.0
Oracle Communications Cloud Native Core Policy=1.15.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy=1.7.0
Oracle Communications Cloud Native Core Unified Data Repository=1.15.0
Oracle Communications Diameter Signaling Router>=8.0.0.0<=8.5.0.2
Oracle Communications Instant Messaging Server=8.1
Oracle Helidon=1.4.10
Oracle Helidon=2.4.0
Oracle PeopleSoft Enterprise PeopleTools=8.48
Oracle PeopleSoft Enterprise PeopleTools=8.57
Oracle PeopleSoft Enterprise PeopleTools=8.58
Oracle PeopleSoft Enterprise PeopleTools=8.59
Oracle WebCenter Portal=12.2.1.3.0
Oracle WebCenter Portal=12.2.1.4.0
NetApp OnCommand Insight
Debian Debian Linux=10.0
Debian Debian Linux=11.0
debian/netty
1:4.1.48-4+deb11u2
1:4.1.48-7+deb12u1
1:4.1.48-10

Remedy

https://www.oracle.com/security-alerts/cpuapr2022.html

Remedy

https://www.oracle.com/security-alerts/cpujan2022.html

Remedy

https://www.oracle.com/security-alerts/cpujul2022.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID?

    The vulnerability ID is CVE-2021-37136.

  • What is the impact of CVE-2021-37136?

    The vulnerability allows for an Out-of-Memory Error (OOME) and can be exploited for a Denial-of-Service (DoS) attack.

  • Which software is affected by CVE-2021-37136?

    All users of Bzip2Decoder are affected.

  • What is the severity of CVE-2021-37136?

    The severity of CVE-2021-37136 is high.

  • How can I fix CVE-2021-37136?

    The recommended fix for CVE-2021-37136 is to update to version 4.1.68 or higher of the affected software.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203