CVE-2021-21419
Medium
Description
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
SeverityMedium
CVSS5.3
Exploit probability78. percentile1.8%
Product
Eventlet
PublishedMay 7, 2021
First seenMay 7, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- eventlet eventlet0.31.0 or later
- eventlet0.31.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eventlet eventlet | 0.10 ≤ v < 0.31.0 | 0.31.0 |
| fedoraproject fedora | 33, 34 | — |
| eventletPyPI | 0.10 ≤ v < 0.31.0, 0.10.0 ≤ v < 0.31.0 | 0.31.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.