p PatchFirst

CVE-2021-37137

CVE-2021-37137

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVSS 7.5 · High · EPSS 6.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • netty

    Versions
    • ≥ unspecified, < 4.1.68Final: Affected (custom)

    Update to 4.1.68Final

  • netty Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-6

    Update to 1:4.1.48-6

  • netty Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-6

    Update to 1:4.1.48-6

  • netty Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-6

    Update to 1:4.1.48-6

  • netty Ubuntu:Pro:14.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
    • 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:16.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:4.0.32-1
    • 1:4.0.33-1
    • 1:4.0.34-1
    Affected ranges
    • ECOSYSTEM: < 1:4.0.34-1ubuntu0.1~esm1

    Update to 1:4.0.34-1ubuntu0.1~esm1

  • netty Ubuntu:Pro:18.04:LTS

    Versions
    • 1:4.1.7-4
    • 1:4.1.7-4ubuntu0.1~esm1
    • 1:4.1.7-4ubuntu0.1
    • 1:4.1.7-4ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.7-4ubuntu0.1+esm2

    Update to 1:4.1.7-4ubuntu0.1+esm2

  • netty Ubuntu:Pro:20.04:LTS

    Versions
    • 1:4.1.33-1
    • 1:4.1.33-2
    • 1:4.1.33-3
    • 1:4.1.45-1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.45-1ubuntu0.1~esm1

    Update to 1:4.1.45-1ubuntu0.1~esm1

  • netty Ubuntu:22.04:LTS

    Versions
    • 1:4.1.48-4
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-4+deb11u1build0.22.04.1

    Update to 1:4.1.48-4+deb11u1build0.22.04.1

Original sources

Check your server →