Vulnerability · Published Feb 17, 2021 · Assigned by Google
CVE-2021-22553Heap Memory exhaustion in Gerrit
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in Gerrit from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 69.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Gerrit | unspecified – before 2.15.22unspecified – before 2.16.26unspecified – before 3.0.16unspecified – before 3.1.12unspecified – before 3.2.7unspecified – before 3.3.2 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://bugs.chromium.org/p/gerrit/issues/detail?id=13858 x_refsource_MISC