CVE-2021-37136
published 2021-10-19CVE-2021-37136: The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
5.65%
92.1th percentile
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | netty | < netty 1:4.1.48-6 (bookworm) | netty 1:4.1.48-6 (bookworm) |
| netty | netty | < 4.1.68 | 4.1.68 |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u1 | 1:4.1.48-4+deb11u1 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u1build0.22.04.1 | 1:4.1.48-4+deb11u1build0.22.04.1 |
| netty | netty | >= 0 < 1:4.0.34-1ubuntu0.1~esm1 | 1:4.0.34-1ubuntu0.1~esm1 |
| netty | netty | >= 0 < 1:4.1.7-4ubuntu0.1+esm2 | 1:4.1.7-4ubuntu0.1+esm2 |
| netty | netty | >= 0 < 1:4.1.45-1ubuntu0.1~esm1 | 1:4.1.45-1ubuntu0.1~esm1 |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | 18.1 – 18.3 | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | coherence | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Centralized Thirdparty Jars (Netty) — CVE-2021-37136
vendor_oracle·2023-10-15·CVSS 7.5
CVE-2021-37136 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Centralized Thirdparty Jars (Netty) — CVE-2021-37136
Oracle Oracle Fusion Middleware Risk Matrix: Centralized Thirdparty Jars (Netty) vulnerability
CVE: CVE-2021-37136
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2023-04-28·CVSS 7.5
CVE-2021-21295 [HIGH] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue
Red Hat
netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
vendor_redhat·2021-09-09·CVSS 7.5
CVE-2021-37136 [HIGH] CWE-400 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.
Statement: In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been
Debian
CVE-2021-37136: netty - The Bzip2 decompression decoder function doesn't allow setting size restrictions...
vendor_debian·2021·CVSS 7.5
CVE-2021-37136 [HIGH] CVE-2021-37136: netty - The Bzip2 decompression decoder function doesn't allow setting size restrictions...
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Scope: local
bookworm: resolved (fixed in 1:4.1.48-6)
bullseye: resolved (fixed in 1:4.1.48-4+deb11u1)
forky: resolved (fixed in 1:4.1.48-6)
sid: resolved (fixed in 1:4.1.48-6)
trixie: resolved (fixed in 1:4.1.48-6)
OSV
netty vulnerabilities
osv·2023-04-28·CVSS 7.5
CVE-2020-11612 [HIGH] netty vulnerabilities
netty vulnerabilities
It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2021-21295,
CVE-2021
OSV
CVE-2021-37136: The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size us
osv·2021-10-19·CVSS 7.5
CVE-2021-37136 [HIGH] CVE-2021-37136: The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size us
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
GHSA
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
ghsa·2021-09-09
CVE-2021-37136 [HIGH] CWE-400 Bzip2Decoder doesn't allow setting size restrictions for decompressed data
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
### Impact
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
### Workarounds
No workarounds other than not using the `Bzip2Decoder`
### References
Relevant code areas:
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/code
OSV
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
osv·2021-09-09
CVE-2021-37136 [HIGH] Bzip2Decoder doesn't allow setting size restrictions for decompressed data
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
### Impact
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
### Workarounds
No workarounds other than not using the `Bzip2Decoder`
### References
Relevant code areas:
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/code
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
bugzilla·2021-09-14·CVSS 7.5
CVE-2021-37136 [HIGH] CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack.
Reference:
https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
Discussion:
Marking Red Hat AMQ Broker 7 as having a low impact, this is because although a vulnerable version of netty is used it does not use Bzip2 compression/decompression.
---
Marking Fuse 6 as OOSS and adjusting Fuse 7 to Low Impact. Netty-codec vulnerable version is present but no use of Bzip2 compression/decompression.
--
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vvhttps://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20220210-0012/https://www.debian.org/security/2023/dsa-5316https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vvhttps://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20220210-0012/https://www.debian.org/security/2023/dsa-5316https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2021-10-19
Published