NetSight
IP …
high7.5

CVE-2021-37137

SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way

Impact

### Impact The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. ### Impact All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage. ### References https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171 https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185

Affected packages

EcosystemPackageAffectedFixed in
mavenio.netty:netty-codec>= 4.0.0, < 4.1.68.Final4.1.68.Final
mavenorg.jboss.netty:netty< 4.0.0none recorded
mavenio.netty:netty< 4.0.0none recorded

Affected products

VendorProductAffected versions
NettyNetty
before 4.1.68
OracleBanking Apis
from 18.1 through 18.3
Versions 19.1, 19.2, 20.1, 21.1
OracleBanking Digital Experience
Versions 18.1, 18.2, 18.3, 19.1, 19.2, 20.1
OracleCommerce Guided Search
Version 11.3.2
OracleCommunications Brm - Elastic Charging Engine
before 12.0.0.4.6
Version 12.0.0.5.0
OracleCommunications Cloud Native Core Binding Support Function
Version 1.10.0
OracleCommunications Diameter Signaling Router
from 8.0.0.0 through 8.5.0.2
OraclePeoplesoft Enterprise Peopletools
Versions 8.57, 8.58, 8.59
OracleWebcenter Portal
Versions 12.2.1.3.0, 12.2.1.4.0
QuarkusQuarkus
before 2.2.4
NetappOncommand Insight
All versions
DebianDebian Linux
Versions 10.0, 11.0

Weakness classification

CWE-400

References