logo

Database

Improper resource allocation In netty

Description

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2021-371372. NVD-2021-371373. OSV-2021-371374. OSV-DEBIAN-2021-371375. GHSA-9vjp-v76f-g3636. GCVE-2021-371377. GHSA-9vjp-v76f-g3638. lists.debian.org9. SECURITY-TRACKER-CVE-2021-37137

References

1. https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3Cdev.tinkerpop.apache.org%3E2. https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3Ccommits.druid.apache.org%3E3. https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3Ccommits.druid.apache.org%3E4. https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3Ccommits.druid.apache.org%3E5. https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3Ccommits.druid.apache.org%3E6. https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3Ccommits.druid.apache.org%3E7. https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g3638. https://github.com/netty/netty/commit/6da4956b31023ae967451e1d94ff51a746a9194f9. https://www.oracle.com/security-alerts/cpujul2022.html10. https://www.oracle.com/security-alerts/cpujan2022.html11. https://www.oracle.com/security-alerts/cpuapr2022.html12. https://www.debian.org/security/2023/dsa-531613. https://security.netapp.com/advisory/ntap-20220210-001214. https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L7915. https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L18516. https://github.com/netty/netty/blob/4.1/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.