You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Netty is an asynchronous event-driven network application framework for
rapid development of maintainable high performance protocol servers and
clients.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
mend-for-github-combot
changed the title
CVE-2021-37136 (High) detected in netty-codec-4.1.48.Final.jar
CVE-2021-37136 (High) detected in netty-codec-4.1.48.Final.jar - autoclosed
Oct 3, 2022
CVE-2021-37136 - High Severity Vulnerability
Vulnerable Library - netty-codec-4.1.48.Final.jar
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: https://netty.io/
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.48.Final/netty-codec-4.1.48.Final.jar
Dependency Hierarchy:
Found in HEAD commit: fe86f33cd99024672f7ca7f018f0767c3afe7cf5
Found in base branch: main
Vulnerability Details
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Publish Date: 2021-10-19
URL: CVE-2021-37136
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-grg4-wf29-r9vv
Release Date: 2021-10-19
Fix Resolution (io.netty:netty-codec): 4.1.68.Final
Direct dependency fix Resolution (com.amazonaws:aws-java-sdk): 1.11.875
⛑️ Automatic Remediation is available for this issue
The text was updated successfully, but these errors were encountered: