Lucene search

GitHub_MCVE-2021-21419

HistoryMay 07, 2021 - 3:15 p.m.

CVE-2021-21419

2021-05-0715:15:07

CWE-400

GitHub_M

web.nvd.nist.gov

eventlet

memory exhaustion

python

networking

cve-2021-21419

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

Affected configurations

Nvd

Vulners

Node

eventleteventletRange0.10–0.31.0

Node

fedoraprojectfedoraMatch33

fedoraprojectfedoraMatch34

VendorProductVersionCPE
eventleteventlet*cpe:2.3:a:eventlet:eventlet:*:*:*:*:*:*:*:*
fedoraprojectfedora33cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
fedoraprojectfedora34cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eventlet	eventlet	*	cpe:2.3:a:eventlet:eventlet::::::::
fedoraproject	fedora	33	cpe:2.3:o:fedoraproject:fedora:33:::::::*
fedoraproject	fedora	34	cpe:2.3:o:fedoraproject:fedora:34:::::::*

CNA Affected

[
  {
    "product": "eventlet",
    "vendor": "eventlet",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.10, < 0.31.0"
      }
    ]
  }
]