Bugzilla – Bug 1190613
VUL-0: CVE-2021-37137: netty: netty-codec: SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
Last modified: 2024-05-31 13:10:02 UTC
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. Reference: https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363 References: https://bugzilla.redhat.com/show_bug.cgi?id=2004135 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37137
Affected packages: - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/netty 4.1.8.Final - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty 4.1.44.Final - SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty 4.1.44.Final - openSUSE:Backports:SLE-15-SP2/netty 4.1.13 - openSUSE:Backports:SLE-15-SP3/netty 4.1.13 - openSUSE:Backports:SLE-15-SP4/netty 4.1.13 - openSUSE:Factory/netty 4.1.60 Upstream patch: https://github.com/netty/netty/commit/6da4956b31023ae967451e1d94ff51a746a9194f
SUSE-SU-2022:1271-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1182103,1183262,1190610,1190613,1193672 CVE References: CVE-2021-21290,CVE-2021-21295,CVE-2021-37136,CVE-2021-37137,CVE-2021-43797 JIRA References: Sources used: openSUSE Leap 15.4 (src): netty-4.1.75-150200.4.6.2 openSUSE Leap 15.3 (src): netty-4.1.75-150200.4.6.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Reassigning to Pedro for SUMA codestreams. Pedro, could you please ensure that SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty and SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty will get the fix for this CVE? :) Again, if you finally plan to release a new 4.0 version, please include a fix for this bug.
(In reply to Thomas Leroy from comment #6) > Reassigning to Pedro for SUMA codestreams. > > Pedro, could you please ensure that > SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty and > SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty will get the fix for > this CVE? :) > > Again, if you finally plan to release a new 4.0 version, please include a > fix for this bug. I guess Julio is the correct person. My apologies for the confusion
SUSE-SU-2022:3617-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src): netty-4.1.44.Final-150300.4.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3760-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (src): netty-4.1.44.Final-150400.3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3793-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src): netty-4.1.44.Final-150200.3.4.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
All done, closing.