Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
GHSA-9p9m-jm8w-94p2 · CVE-2021-21419 · PYSEC-2021-12
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame.
Patches
Version 0.31.0 restricts websocket frame to reasonable limits.
Workarounds
Restricting memory usage via OS limits would help against overall machine exhaustion. No workaround to protect Eventlet process.
For more information
If you have any questions or comments about this advisory:
- Open an issue in eventlet
- Contact current maintainers. At 2021-03: temotor@gmail.com or https://t.me/temotor
References
- WEB https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-21419
- WEB https://github.com/eventlet/eventlet/commit/1412f5e4125b4313f815778a1acb4d3336efcd07
- PACKAGE https://github.com/eventlet/eventlet
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/eventlet/PYSEC-2021-12.yaml
- WEB https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L
- WEB https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB
Ready to move
Start Securing
Free, no credit card | First findings in minutes