CVE-2021-21419: Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
Impact A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame.
Patches Version 0.31.0 restricts websocket frame to reasonable limits.
Workarounds Restricting memory usage via OS limits would help against overall machine exhaustion. No workaround to protect Eventlet process.
For more information If you have any questions or comments about this advisory: Open an issue in eventlet Contact current maintainers. At 2021-03: temotor@gmail.com or https://t.me/temotor
Other sources
A flaw was found in eventlet. If an unauthenticated user manages to send large websocket frames or highly compressed data frames that can lead to memory exhaustion. An attacker could use this flaw to cause a denial of service (DoS).
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-21419?
CVE-2021-21419 has a medium severity rating due to the potential for memory exhaustion from large websocket frames.
How do I fix CVE-2021-21419?
To fix CVE-2021-21419, upgrade to Eventlet version 0.31.0 or later.
What types of software are affected by CVE-2021-21419?
CVE-2021-21419 affects Eventlet versions prior to 0.31.0, primarily in applications using Python with Eventlet.
Can CVE-2021-21419 be exploited remotely?
Yes, CVE-2021-21419 can be exploited remotely by a malicious websocket peer sending oversized frames.
What is the impact of CVE-2021-21419 on systems?
The impact of CVE-2021-21419 is significant memory exhaustion on the Eventlet side, potentially leading to denial of service.