CVE-2021-37137
High
Description
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Netty
PublishedOct 19, 2021
First seenOct 19, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- netty netty4.1.68 or later
- oracle communications_brm_-_elastic_charging_engine12.0.0.4.6 or later
- quarkus quarkus2.2.4 or later
- io.netty:netty-codec4.1.68.Final or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.68 | 4.1.68 |
| oracle banking_apis | 18.1 ≤ v ≤ 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_digital_experience | 18.1, 18.2, 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle communications_brm_-_elastic_charging_engine | v < 12.0.0.4.6, 12.0.0.5.0 | 12.0.0.4.6 |
| oracle communications_cloud_native_core_binding_support_function | 1.10.0 | — |
| oracle communications_diameter_signaling_router | 8.0.0.0 ≤ v ≤ 8.5.0.2 | — |
| oracle peoplesoft_enterprise_peopletools | 8.57, 8.58, 8.59 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
| quarkus quarkus | v < 2.2.4 | 2.2.4 |
| netapp oncommand_insight | No range specified | — |
| debian debian_linux | 10.0, 11.0 | — |
| io.netty:netty-codecMaven | 4.0.0 ≤ v < 4.1.68.Final | 4.1.68.Final |
| org.jboss.netty:nettyMaven | No range specified | — |
| io.netty:nettyMaven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.