Dnspython is vulnerable to a denial of service, caused by a flaw in stub resolver when a bad-in-some-way response arrives before a legitimate one on the UDP port dnspython is using for that query. By sending a specially crafted query, a remote attacker could exploit this vulnerability to cause a denial of service condition.

Impact The Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.

This vulnerability could enable attackers to: - Bypass front-end security controls - Launch targeted attacks against active site users - Poison web caches

Patches Problem has been patched in eventlet 0.40.3.

The patch just drops trailers. If a backend behind eventlet.wsgi proxy requires trailers, then this patch BREAKS your setup.

Workarounds Do not use eventlet.wsgi facing untrusted clients.

References - Patch https://github.com/eventlet/eventlet/pull/1062 - This issue is similar to https://github.com/advisories/GHSA-9548-qrrj-x5pj

Impact A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame.

Patches Version 0.31.0 restricts websocket frame to reasonable limits.

Workarounds Restricting memory usage via OS limits would help against overall machine exhaustion. No workaround to protect Eventlet process.

For more information If you have any questions or comments about this advisory: Open an issue in eventlet Contact current maintainers. At 2021-03: temotor@gmail.com or https://t.me/temotor