Vulnerability · Published Oct 19, 2021 · Assigned by JFROG
CVE-2021-37136
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Netty from The Netty project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)5.9%top 6.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | 1:4.1.48-6 | DEBIAN-CVE-2021-37136 |
| Debian:13 | netty | 1:4.1.48-6 | DEBIAN-CVE-2021-37136 |
| Debian:14 | netty | 1:4.1.48-6 | DEBIAN-CVE-2021-37136 |
| Maven | io.netty:netty | no fix listed | GHSA-grg4-wf29-r9vv |
| Maven | io.netty:netty-codec | 4.1.68.Final | GHSA-grg4-wf29-r9vv |
| Maven | org.jboss.netty:netty | no fix listed | GHSA-grg4-wf29-r9vv |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:8506 |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | USN-6049-1 |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | UBUNTU-CVE-2021-37136 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Netty project | Netty | unspecified – before 4.1.68Final |
Weakness: CWE-400
References
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
- [tinkerpop-dev] 20211025 [jira] [Created] (TINKERPOP-2632) Netty 4.1.61 flagged with two high severity security violations mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211025 [GitHub] [druid] a2l007 commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211026 [GitHub] [druid] clintropolis merged pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211026 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update mailing-list
- DSA-5316 vendor-advisory