CVE-2021-37136: High severity Netty Netty vulnerability
Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Workarounds No workarounds other than not using the Bzip2Decoder
References
Relevant code areas:
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305
Other sources
A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack.
Reference: https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-37136.
What is the impact of CVE-2021-37136?
The vulnerability allows for an Out-of-Memory Error (OOME) and can be exploited for a Denial-of-Service (DoS) attack.
Which software is affected by CVE-2021-37136?
All users of Bzip2Decoder are affected.
What is the severity of CVE-2021-37136?
The severity of CVE-2021-37136 is high.
How can I fix CVE-2021-37136?
The recommended fix for CVE-2021-37136 is to update to version 4.1.68 or higher of the affected software.