CVE-2021-37136: Bzip2Decoder Size Restriction Vulnerability in io.netty:netty-codec
Summary
CVE-2021-37136: Bzip2Decoder doesn't allow setting size restrictions for decompressed data. Affects io.netty:netty-codec versions < 4.1.68.Final. Fixed in 4.1.68.Final. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2021-37136 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The io.netty:netty-codec package is a part of the Netty framework, which is a highly scalable event-driven networking library for Java. It provides an implementation of various network protocols and codecs for efficient data transfer. The Bzip2Decoder class in this package is responsible for decompressing data compressed using the Bzip2 algorithm. However, it lacks the ability to set size restrictions on the decompressed output data, leading to potential memory allocation issues during decompression.
Vulnerability Detail
The Bzip2Decoder in io.netty:netty-codec does not allow setting size restrictions on the decompressed output data. This means that an attacker can provide malicious input that triggers an OutOfMemoryError (OOME) and causes a Denial of Service (DoS) attack. By exploiting this vulnerability, an attacker can exhaust the system's memory resources, rendering it unresponsive and impacting its availability. The affected versions of the package are from 0 to 4.1.67.Final.
How To Fix
Minimum fixed version
4.1.68.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability other than not using the Bzip2Decoder class from io.netty:netty-codec. If the functionality provided by Bzip2Decoder is not essential for the application, it is recommended to remove its usage to mitigate the risk of exploitation.
Conclusion
The Bzip2Decoder size restriction vulnerability in io.netty:netty-codec can be exploited by providing malicious input to trigger an OutOfMemoryError and perform a Denial of Service attack. It is crucial to upgrade to the latest secure version of the package (4.1.68.Final or later) to mitigate this vulnerability. If the Bzip2Decoder functionality is not necessary, it is recommended to remove its usage. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-codec →
FAQ
The vulnerability allows an attacker to trigger an OutOfMemoryError and perform a Denial of Service attack by providing malicious input. This can lead to system unresponsiveness and impact availability.
The vulnerability affects versions 0 to 4.1.67.Final of io.netty:netty-codec.
No, there are no known workarounds for this vulnerability other than not using the Bzip2Decoder class.
Yes, this vulnerability has been assigned the CVE identifier CVE-2021-37136.
To fix this vulnerability, upgrade to version 4.1.68.Final or later of io.netty:netty-codec.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
