Vulnerability · Published Oct 19, 2021 · Assigned by JFROG
CVE-2021-37137
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Netty from The Netty project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | 1:4.1.48-6 | DEBIAN-CVE-2021-37137 |
| Debian:13 | netty | 1:4.1.48-6 | DEBIAN-CVE-2021-37137 |
| Debian:14 | netty | 1:4.1.48-6 | DEBIAN-CVE-2021-37137 |
| Maven | io.netty:netty | no fix listed | GHSA-9vjp-v76f-g363 |
| Maven | io.netty:netty-codec | 4.1.68.Final | GHSA-9vjp-v76f-g363 |
| Maven | org.jboss.netty:netty | no fix listed | GHSA-9vjp-v76f-g363 |
| Rocky Linux:8 | libdb | 0:5.3.28-42.el8_4 | RLSA-2022:8506 |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | USN-6049-1 |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u1build0.22.04.1 | UBUNTU-CVE-2021-37137 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Netty project | Netty | unspecified – before 4.1.68Final |
Weakness: CWE-400
References
- https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363
- [tinkerpop-dev] 20211025 [jira] [Created] (TINKERPOP-2632) Netty 4.1.61 flagged with two high severity security violations mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson opened a new pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211025 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211025 [GitHub] [druid] a2l007 commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211026 [GitHub] [druid] clintropolis merged pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- [druid-commits] 20211026 [GitHub] [druid] jihoonson commented on pull request #11844: Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update mailing-list
- DSA-5316 vendor-advisory