p PatchFirst

CVE-2021-21419

CVE-2021-21419 · Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

CVSS 5.3 · Medium · EPSS 1.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • eventlet

    Versions
    • >= 0.10, < 0.31.0: Affected

    No fix published

  • python-eventlet Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.26.1-7

    Update to 0.26.1-7

  • python-eventlet Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.26.1-7

    Update to 0.26.1-7

  • python-eventlet Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.26.1-7

    Update to 0.26.1-7

  • eventlet PyPI

    Versions
    • 0.10.0
    • 0.11.0
    • 0.12.1
    • 0.13.0
    • 0.14.0
    • 0.15.2
    • 0.16.1
    • 0.17.4
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.19.0
    • 0.20.0
    • 0.20.1
    • 0.21.0
    • 0.22.0
    • 0.22.1
    • 0.23.0
    • 0.24.0
    • 0.24.1
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.26.0
    • 0.26.1
    • 0.27.0
    • 0.28.0
    • 0.28.1
    • 0.29.0
    • 0.29.1
    • 0.30.0
    • 0.30.1
    • 0.30.2
    • 0.30.3
    Affected ranges
    • ECOSYSTEM: ≥ 0.10, < 0.31.0

    Update to 0.31.0

  • eventlet PyPI

    Versions
    • 0.10.0
    • 0.11.0
    • 0.12.1
    • 0.13.0
    • 0.14.0
    • 0.15.2
    • 0.16.1
    • 0.17.4
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.19.0
    • 0.20.0
    • 0.20.1
    • 0.21.0
    • 0.22.0
    • 0.22.1
    • 0.23.0
    • 0.24.0
    • 0.24.1
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.26.0
    • 0.26.1
    • 0.27.0
    • 0.28.0
    • 0.28.1
    • 0.29.0
    • 0.29.1
    • 0.30.0
    • 0.30.1
    • 0.30.2
    • 0.30.3
    Affected ranges
    • ECOSYSTEM: ≥ 0.10.0, < 0.31.0

    Update to 0.31.0

  • python-eventlet Ubuntu:20.04:LTS

    Versions
    • 0.25.0-0ubuntu1
    • 0.25.1-2build1
    • 0.25.1-2ubuntu1
    Affected ranges
    • ECOSYSTEM: < 0.25.1-2ubuntu1.1

    Update to 0.25.1-2ubuntu1.1

Original sources

Check your server →