CVE-2021-21419

Name
CVE-2021-21419
Description
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
CONFIRM https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5JZP4LZOSP7CUAM3GIRW6PIAWKH5VGB/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WJFSBPLCNSZNHYQC4QDRDFRTEZRMD2L/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:eventlet:eventlet:*:*:*:*:*:*:*:* eventlet >= 0.10: < 0.31.0:
cpe:2.3:a:eventlet:eventlet:*:*:*:*:*:*:*:* eventlet >= 0.10 < 0.31.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status