PT-2021-3910 · Eventlet+3 · Eventlet+3

Temotopublished · Published 2021-05-07 · Updated 2024-12-06 · CVE-2021-21419

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Eventlet versions prior to 0.31.0

Description The issue is related to the handling of large websocket frames in the Eventlet library, which can lead to memory exhaustion. A malicious peer can exploit this by sending highly compressed data frames, potentially causing a denial of service. The estimated number of potentially affected devices is not provided.

Recommendations For versions prior to 0.31.0, update to version 0.31.0 to restrict websocket frames to reasonable limits. As a temporary workaround, consider restricting memory usage via OS limits to help against overall machine exhaustion, although this will not protect the Eventlet process itself.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2021-04421

CVE-2021-21419

GHSA-9P9M-JM8W-94P2

MGASA-2021-0266

PYSEC-2021-12

RHSA-2021:2437

RHSA-2021:5071

SUSE-SU-2021:2554-1

SUSE-SU-2021:3729-1

USN-4956-1

Affected Products

Astra Linux

Eventlet

Linuxmint

Ubuntu

References · 88

• https://osv.dev/vulnerability/SUSE-SU-2021:3729-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21419 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4956-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0266.html · Security Note
• https://ubuntu.com/security/notices/USN-4956-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21419 · Security Note
• https://bdu.fstec.ru/vul/2021-04421 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:2554-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p9m-jm8w-94p2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-12 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB · Vendor Advisory