GitHub Advisoryadvisory · Maven
GHSA-grg4-wf29-r9vv Bzip2Decoder doesn't allow setting size restrictions for decompressed data
HIGH
Official page ↗
- Aliases
- CVE-2021-37136
- Ecosystem
- Maven
- Packages
- io.netty:netty-codec, org.jboss.netty:netty, io.netty:netty
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2021-09-09
Affected packages
• Maven io.netty:netty-codec: < 4.1.68.Final → fixed in 4.1.68.Final
• Maven org.jboss.netty:netty: < 4.0.0 (no fix yet)
• Maven io.netty:netty: < 4.0.0 (no fix yet)
Description
Impact
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).
All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Workarounds
No workarounds other than not using the `Bzip2Decoder`
References
Relevant code areas:
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305
Related
Alias · CVE (1)
- CVE-2021-37136 The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the… vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv web
- https://nvd.nist.gov/vuln/detail/CVE-2021-37136 advisory
- https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020 web
- https://www.oracle.com/security-alerts/cpujul2022.html web
- https://www.oracle.com/security-alerts/cpujan2022.html web
- https://www.oracle.com/security-alerts/cpuapr2022.html web
- https://www.debian.org/security/2023/dsa-5316 web
- https://security.netapp.com/advisory/ntap-20220210-0012 web
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html web
- https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E web
- https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E web
- https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E web
- https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E web
- https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E web
- https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E web
- https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80 web
- https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305 web
- https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294 web
- https://github.com/netty/netty package