GHSA-grg4-wf29-r9vv
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
At a glance
- Published
- Updated
- CVE
- CVE-2021-37136
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack ### Workarounds No workarounds other than not using the `Bzip2Decoder` ### References Relevant code areas: https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305
Affected packages
| Package | Versions |
|---|---|
| Maven · io.netty:netty-codec | introduced 0, fixed 4.1.68.Final |
| Maven · org.jboss.netty:netty | introduced 0 |
| Maven · io.netty:netty | introduced 0 |
References
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-37136 ADVISORY
- https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020 WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
- https://www.oracle.com/security-alerts/cpujan2022.html WEB
- https://www.oracle.com/security-alerts/cpuapr2022.html WEB
- https://www.debian.org/security/2023/dsa-5316 WEB
- https://security.netapp.com/advisory/ntap-20220210-0012 WEB
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html WEB
- https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E WEB
- https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E WEB
- https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E WEB
- https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E WEB
- https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E WEB
- https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E WEB
- https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80 WEB
- https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305 WEB
- https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294 WEB
- https://github.com/netty/netty PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |