You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
mend-bolt-for-githubbot
changed the title
CVE-2021-37137 (Medium) detected in netty-codec-4.1.65.Final.jar
CVE-2021-37137 (High) detected in netty-codec-4.1.65.Final.jar
Sep 30, 2021
CVE-2021-37137 - High Severity Vulnerability
Vulnerable Library - netty-codec-4.1.65.Final.jar
Library home page: https://netty.io/
Path to dependency file: /service/pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.65.Final/netty-codec-4.1.65.Final.jar
Dependency Hierarchy:
Found in HEAD commit: e06450ec74120f14841ee9ab6e6bb6c0ba83b92e
Found in base branch: master
Vulnerability Details
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
Publish Date: 2021-10-19
URL: CVE-2021-37137
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9vjp-v76f-g363
Release Date: 2021-10-19
Fix Resolution (io.netty:netty-codec): 4.1.68.Final
Direct dependency fix Resolution (software.amazon.awssdk:s3): 2.16.67
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: