Bug 1958407 (CVE-2021-21419) - CVE-2021-21419 python-eventlet: improper handling of highly compressed data and memory allocation with excessive size allows DoS
Summary: CVE-2021-21419 python-eventlet: improper handling of highly compressed data a...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-21419
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1958409 1960182 1958408 1958410 1958802 1958838 1959271 1959272
Blocks: 1958411
TreeView+ depends on / blocked
 
Reported: 2021-05-07 20:32 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-20 14:30 UTC (History)
21 users (show)

Fixed In Version: eventlet 0.31.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in eventlet. If an unauthenticated user manages to send large websocket frames or highly compressed data frames that can lead to memory exhaustion. An attacker could use this flaw to cause a denial of service (DoS).
Clone Of:
Environment:
Last Closed: 2021-07-28 01:07:37 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2437 0 None None None 2021-07-27 22:07:37 UTC
Red Hat Product Errata RHSA-2021:5071 0 None None None 2021-12-09 20:16:45 UTC

Description Guilherme de Almeida Suckevicz 2021-05-07 20:32:29 UTC 
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

Reference:
https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2
Comment 1 Guilherme de Almeida Suckevicz 2021-05-07 20:33:30 UTC 
Created python-eventlet tracking bugs for this issue:

Affects: epel-all [bug 1958409]
Affects: fedora-all [bug 1958408]
Affects: openstack-rdo [bug 1958410]
Comment 2 Hardik Vyas 2021-05-10 06:41:51 UTC 
Upstream fix: https://github.com/eventlet/eventlet/commit/1412f5e4125b4313f815778a1acb4d3336efcd07
Comment 8 Hardik Vyas 2021-05-11 03:55:23 UTC 
Statement:

In OpenShift Container Platform 4, the python-eventlet package is only used in Ironic container images, used for Baremetal provisioning, and Kuryr SDN container images, used for deployments on OpenStack.

In Red Hat Gluster Storage 3, python-eventlet package was primarily shipped as a dependency of openstack-swift. However, Openstack Swift is no longer supported with the recent release of Red Hat Gluster Storage 3.5.
Comment 15 errata-xmlrpc 2021-07-27 22:07:38 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:2437 https://access.redhat.com/errata/RHSA-2021:2437
Comment 16 Product Security DevOps Team 2021-07-28 01:07:37 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21419
Comment 17 errata-xmlrpc 2021-12-09 20:16:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2021:5071 https://access.redhat.com/errata/RHSA-2021:5071
Note You need to log in before you can comment on or make changes to this bug.