NetSight
IP …
high7.5

CVE-2021-37136

Bzip2Decoder doesn't allow setting size restrictions for decompressed data

Impact

### Impact The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack ### Workarounds No workarounds other than not using the `Bzip2Decoder` ### References Relevant code areas: https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305

Affected packages

EcosystemPackageAffectedFixed in
mavenio.netty:netty-codec< 4.1.68.Final4.1.68.Final
mavenorg.jboss.netty:netty< 4.0.0none recorded
mavenio.netty:netty< 4.0.0none recorded

Affected products

VendorProductAffected versions
NettyNetty
before 4.1.68
QuarkusQuarkus
before 2.2.4
OracleBanking Apis
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Digital Experience
Versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
OracleCoherence
Versions 12.2.1.4.0, 14.1.1.0.0
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Brm - Elastic Charging Engine
before 12.0.0.4.6
Version 12
OracleCommunications Cloud Native Core Binding Support Function
Versions 1.10.0, 1.11.0
OracleCommunications Cloud Native Core Network Slice Selection Function
Version 1.8.0
OracleCommunications Cloud Native Core Policy
Version 1.15.0
OracleCommunications Cloud Native Core Security Edge Protection Proxy
Version 1.7.0
OracleCommunications Cloud Native Core Unified Data Repository
Version 1.15.0

Weakness classification

CWE-400

References