CVE-2021-37136
Published: 19 October 2021
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
Priority
Status
| Package | Release | Status |
|---|---|---|
|
netty
Launchpad, Ubuntu, Debian |
bionic |
Released
(1:4.1.7-4ubuntu0.1+esm2)
Available with Ubuntu Pro |
| focal |
Released
(1:4.1.45-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
| hirsute |
Ignored
(end of life)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Released
(1:4.1.48-4+deb11u1build0.22.04.1)
|
|
| kinetic |
Released
(1:4.1.48-5ubuntu0.1)
|
|
| lunar |
Ignored
(end of life, was needs-triage)
|
|
| mantic |
Ignored
(end of life, was needs-triage)
|
|
| noble |
Needs triage
|
|
| trusty |
Needs triage
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(1:4.0.34-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |