High severityNVD Advisory· Published Oct 19, 2021· Updated Aug 4, 2024
CVE-2021-37136
CVE-2021-37136
Description
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.netty:netty-codecMaven | < 4.1.68.Final | 4.1.68.Final |
org.jboss.netty:nettyMaven | >= 0 | — |
io.netty:nettyMaven | >= 0 | — |
Affected products
12- osv-coords11 versionspkg:apk/chainguard/druid-compatpkg:apk/chainguard/hadoop-fips-3.3.6pkg:apk/wolfi/druid-compatpkg:maven/io.netty/nettypkg:maven/io.netty/netty-codecpkg:maven/org.jboss.netty/nettypkg:rpm/opensuse/netty&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/netty&distro=openSUSE%20Tumbleweedpkg:rpm/suse/netty&distro=SUSE%20Manager%20Server%20Module%204.1pkg:rpm/suse/netty&distro=SUSE%20Manager%20Server%20Module%204.2pkg:rpm/suse/netty&distro=SUSE%20Manager%20Server%20Module%204.3
< 34.0.0-r6+ 10 more
- (no CPE)range: < 34.0.0-r6
- (no CPE)range: < 3.3.6-r0
- (no CPE)range: < 34.0.0-r6
- (no CPE)range: >= 0
- (no CPE)range: < 4.1.68.Final
- (no CPE)range: >= 0
- (no CPE)range: < 4.1.75-150200.4.6.2
- (no CPE)range: < 4.1.114-1.1
- (no CPE)range: < 4.1.44.Final-150200.3.4.2
- (no CPE)range: < 4.1.44.Final-150300.4.3.2
- (no CPE)range: < 4.1.44.Final-150400.3.3.2
- The Netty project/Nettyv5Range: unspecified
Patches
Vulnerability mechanics
References
26- github.com/advisories/GHSA-grg4-wf29-r9vvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-37136ghsaADVISORY
- www.debian.org/security/2023/dsa-5316ghsavendor-advisoryWEB
- github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.javaghsaWEB
- github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.javaghsaWEB
- github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.javaghsaWEB
- github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020ghsaWEB
- github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vvghsaWEB
- lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3Emitremailing-list
- lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3EghsaWEB
- lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3Emitremailing-list
- lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3EghsaWEB
- lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3Emitremailing-list
- lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3EghsaWEB
- lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3Emitremailing-list
- lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3Emitremailing-list
- lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3EghsaWEB
- lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3Emitremailing-list
- lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3EghsaWEB
- lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlghsamailing-listWEB
- security.netapp.com/advisory/ntap-20220210-0012ghsaWEB
- www.oracle.com/security-alerts/cpuapr2022.htmlghsaWEB
- www.oracle.com/security-alerts/cpujan2022.htmlghsaWEB
- www.oracle.com/security-alerts/cpujul2022.htmlghsaWEB
- security.netapp.com/advisory/ntap-20220210-0012/mitre
News mentions
0No linked articles in our index yet.