CVE-2021-37137
published 2021-10-19CVE-2021-37137: The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
6.28%
92.8th percentile
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | netty | < netty 1:4.1.48-6 (bookworm) | netty 1:4.1.48-6 (bookworm) |
| netty | netty | < 4.1.68 | 4.1.68 |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u1 | 1:4.1.48-4+deb11u1 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u1build0.22.04.1 | 1:4.1.48-4+deb11u1build0.22.04.1 |
| netty | netty | >= 0 < 1:4.0.34-1ubuntu0.1~esm1 | 1:4.0.34-1ubuntu0.1~esm1 |
| netty | netty | >= 0 < 1:4.1.7-4ubuntu0.1+esm2 | 1:4.1.7-4ubuntu0.1+esm2 |
| netty | netty | >= 0 < 1:4.1.45-1ubuntu0.1~esm1 | 1:4.1.45-1ubuntu0.1~esm1 |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | — | — |
| oracle | banking_apis | 18.1 – 18.3 | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | banking_digital_experience | — | — |
| oracle | commerce_guided_search | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Snappy) — CVE-2021-37137
vendor_oracle·2024-10-15·CVSS 7.5
CVE-2021-37137 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (Snappy) — CVE-2021-37137
Oracle Oracle Communications Applications Risk Matrix: Core (Snappy) vulnerability
CVE: CVE-2021-37137
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2023-04-28·CVSS 7.5
CVE-2021-21295 [HIGH] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue
Oracle
Oracle Oracle Communications Applications Risk Matrix: 5G gateway (Google Snappy) — CVE-2021-37137
vendor_oracle·2022-07-15·CVSS 7.5
CVE-2021-37137 [HIGH] Oracle Oracle Communications Applications Risk Matrix: 5G gateway (Google Snappy) — CVE-2021-37137
Oracle Oracle Communications Applications Risk Matrix: 5G gateway (Google Snappy) vulnerability
CVE: CVE-2021-37137
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (Netty) — CVE-2021-37137
vendor_oracle·2022-04-15·CVSS 7.5
CVE-2021-37137 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (Netty) — CVE-2021-37137
Oracle Oracle Fusion Middleware Risk Matrix: Security Framework (Netty) vulnerability
CVE: CVE-2021-37137
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Netty) — CVE-2021-37137
vendor_oracle·2022-01-15·CVSS 7.5
CVE-2021-37137 [HIGH] Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Netty) — CVE-2021-37137
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Netty) vulnerability
CVE: CVE-2021-37137
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
vendor_redhat·2021-09-09·CVSS 7.5
CVE-2021-37137 [HIGH] CWE-400 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
A flaw was found in the Netty's netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.
Statement: In OpenShift Co
Debian
CVE-2021-37137: netty - The Snappy frame decoder function doesn't restrict the chunk length which may le...
vendor_debian·2021·CVSS 7.5
CVE-2021-37137 [HIGH] CVE-2021-37137: netty - The Snappy frame decoder function doesn't restrict the chunk length which may le...
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Scope: local
bookworm: resolved (fixed in 1:4.1.48-6)
bullseye: resolved (fixed in 1:4.1.48-4+deb11u1)
forky: resolved (fixed in 1:4.1.48-6)
sid: resolved (fixed in 1:4.1.48-6)
trixie: resolved (fixed in 1:4.1.48-6)
OSV
netty vulnerabilities
osv·2023-04-28·CVSS 7.5
CVE-2020-11612 [HIGH] netty vulnerabilities
netty vulnerabilities
It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2021-21295,
CVE-2021
OSV
CVE-2021-37137: The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage
osv·2021-10-19·CVSS 7.5
CVE-2021-37137 [HIGH] CVE-2021-37137: The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
OSV
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
osv·2021-09-09
CVE-2021-37137 [HIGH] SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
### Impact
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.
This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
### Impact
All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.
### References
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/comp
GHSA
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
ghsa·2021-09-09
CVE-2021-37137 [HIGH] CWE-400 SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
### Impact
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.
This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
### Impact
All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.
### References
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/comp
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
bugzilla·2021-09-14·CVSS 7.5
CVE-2021-37137 [HIGH] CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Reference:
https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363
Discussion:
Marking Red Hat AMQ Broker 7 as having a low impact, this is because although a vulnerable version of netty is used it does not use Snappy (aka. Z
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20220210-0012/https://www.debian.org/security/2023/dsa-5316https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20220210-0012/https://www.debian.org/security/2023/dsa-5316https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2021-10-19
Published