Bug 1958407 (CVE-2021-21419)

Summary:	CVE-2021-21419 python-eventlet: improper handling of highly compressed data and memory allocation with excessive size allows DoS
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, bmontgom, eparis, hvyas, igor.raits, jburrell, jjoyce, jokerman, jschluet, kevin, lhh, lpeer, mburns, mgarciac, nstielau, rpittau, sclewis, sfowler, shamardin, slinaber, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	eventlet 0.31.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in eventlet. If an unauthenticated user manages to send large websocket frames or highly compressed data frames that can lead to memory exhaustion. An attacker could use this flaw to cause a denial of service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-07-28 01:07:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1958408, 1958409, 1958410, 1958802, 1958838, 1959271, 1959272, 1960182
Bug Blocks:	1958411

Description Guilherme de Almeida Suckevicz 2021-05-07 20:32:29 UTC

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

Reference:
https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2

Comment 1 Guilherme de Almeida Suckevicz 2021-05-07 20:33:30 UTC

Created python-eventlet tracking bugs for this issue:

Affects: epel-all [bug 1958409]
Affects: fedora-all [bug 1958408]
Affects: openstack-rdo [bug 1958410]

Comment 2 Hardik Vyas 2021-05-10 06:41:51 UTC

Upstream fix: https://github.com/eventlet/eventlet/commit/1412f5e4125b4313f815778a1acb4d3336efcd07

Comment 8 Hardik Vyas 2021-05-11 03:55:23 UTC

Statement:

In OpenShift Container Platform 4, the python-eventlet package is only used in Ironic container images, used for Baremetal provisioning, and Kuryr SDN container images, used for deployments on OpenStack.

In Red Hat Gluster Storage 3, python-eventlet package was primarily shipped as a dependency of openstack-swift. However, Openstack Swift is no longer supported with the recent release of Red Hat Gluster Storage 3.5.

Comment 15 errata-xmlrpc 2021-07-27 22:07:38 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2437 https://access.redhat.com/errata/RHSA-2021:2437

Comment 16 Product Security DevOps Team 2021-07-28 01:07:37 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21419

Comment 17 errata-xmlrpc 2021-12-09 20:16:44 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:5071 https://access.redhat.com/errata/RHSA-2021:5071