{
"id": "GHSA-grg4-wf29-r9vv",
"aliases": [
"CVE-2021-37136"
],
"details": "### Impact\nThe Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).\n\n\nAll users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack\n\n### Workarounds\nNo workarounds other than not using the `Bzip2Decoder`\n\n### References\n\nRelevant code areas:\n\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294\nhttps://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305",
"summary": "Bzip2Decoder doesn't allow setting size restrictions for decompressed data",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.68.Final"
}
]
}
],
"package": {
"name": "io.netty:netty-codec",
"ecosystem": "Maven"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "org.jboss.netty:netty",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 4.0.0"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "io.netty:netty",
"ecosystem": "Maven"
},
"database_specific": {
"last_known_affected_version_range": "< 4.0.0"
}
}
],
"modified": "2022-02-08T20:39:51Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2021-09-09T17:11:21Z",
"references": [
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
"type": "ADVISORY"
},
{
"url": "https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2022.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2022.html",
"type": "WEB"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html",
"type": "WEB"
},
{
"url": "https://www.debian.org/security/2023/dsa-5316",
"type": "WEB"
},
{
"url": "https://security.netapp.com/advisory/ntap-20220210-0012",
"type": "WEB"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E",
"type": "WEB"
},
{
"url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80",
"type": "WEB"
},
{
"url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305",
"type": "WEB"
},
{
"url": "https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294",
"type": "WEB"
},
{
"url": "https://github.com/netty/netty",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-10-19T15:15:00Z",
"github_reviewed_at": "2021-09-09T14:36:56Z"
}
}