Bugzilla – Bug 1190610
VUL-0: CVE-2021-37136: netty: netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
Last modified: 2022-11-14 10:58:05 UTC
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack. Reference: https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv References: https://bugzilla.redhat.com/show_bug.cgi?id=2004133 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37136
Affected packages: - SUSE:SLE-15-SP1:Update:Products:Manager40:Update/netty 4.1.8.Final - SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty 4.1.44.Final - SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty 4.1.44.Final - openSUSE:Backports:SLE-15-SP2/netty 4.1.13 - openSUSE:Backports:SLE-15-SP3/netty 4.1.13 - openSUSE:Backports:SLE-15-SP4/netty 4.1.13 - openSUSE:Factory/netty 4.1.60 Upstream patch: https://github.com/netty/netty/commit/41d3d61a61608f2223bb364955ab2045dd5e4020
SUSE-SU-2022:1271-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1182103,1183262,1190610,1190613,1193672 CVE References: CVE-2021-21290,CVE-2021-21295,CVE-2021-37136,CVE-2021-37137,CVE-2021-43797 JIRA References: Sources used: openSUSE Leap 15.4 (src): netty-4.1.75-150200.4.6.2 openSUSE Leap 15.3 (src): netty-4.1.75-150200.4.6.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Reassigning to Pedro for SUMA codestreams. Pedro, could you please ensure that SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty and SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty will get the fix for this CVE? :) Again, if you finally plan to release a new 4.0 version, please include a fix for this bug.
(In reply to Thomas Leroy from comment #6) > Reassigning to Pedro for SUMA codestreams. > > Pedro, could you please ensure that > SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty and > SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty will get the fix for > this CVE? :) > > Again, if you finally plan to release a new 4.0 version, please include a > fix for this bug. I guess Julio is the correct person. My apologies for the confusion
SUSE-SU-2022:3617-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src): netty-4.1.44.Final-150300.4.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3760-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (src): netty-4.1.44.Final-150400.3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3793-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src): netty-4.1.44.Final-150200.3.4.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.