CVE-2021-21419 Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
A malicious peer can exhaust memory in the eventlet library by sending large or highly compressed websocket frames, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21419?
CVE-2021-21419 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 7 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
Weakness: CWE-400
Which versions are affected by CVE-2021-21419?
3 open source packages ship an affected version, including eventlet. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
eventlet PyPI | From 0.10 | 0.31.0 |
eventlet PyPI | From 0.10 | 0.31.0 |
eventlet PyPI | From 0.10.0 | 0.31.0 |
Linux distribution packages (2)
python-eventlet Red Hat:openstack:16.1::el8 | All versions | 0:0.25.2-5.el8ost.1 |
python3-eventlet Red Hat:openstack:16.1::el8 | All versions | 0:0.25.2-5.el8ost.1 |
Products include Eventlet Eventlet, Fedoraproject Fedora.
How do I fix CVE-2021-21419?
Upgrade eventlet to 0.31.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21419 being exploited?
There is no known exploitation of CVE-2021-21419 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2021-21419, GHSA-9p9m-jm8w-94p2, MGASA-2021-0266, PYSEC-2021-12, RHSA-2021:5071, UBUNTU-CVE-2021-21419 and 1 more.