cbcvebase.
CVE-2021-22553
published 2021-02-17

CVE-2021-22553: Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session…

PriorityP434high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.36%
27.6th percentile
Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.

Affected

12 ranges
VendorProductVersion rangeFixed in
googlegerrit< 2.15.222.15.22
googlegerrit>= 2.16.0 < 2.16.262.16.26
googlegerrit>= 3.0.0 < 3.0.163.0.16
googlegerrit>= 3.1.0 < 3.1.123.1.12
googlegerrit>= 3.2.0 < 3.2.73.2.7
googlegerrit>= 3.3.0 < 3.3.23.3.2
google_llcgerrit>= unspecified < 2.15.222.15.22
google_llcgerrit>= unspecified < 2.16.262.16.26
google_llcgerrit>= unspecified < 3.0.163.0.16
google_llcgerrit>= unspecified < 3.1.123.1.12
google_llcgerrit>= unspecified < 3.2.73.2.7
google_llcgerrit>= unspecified < 3.3.23.3.2

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.