Bzip2Decoder doesn't allow setting size restrictions for decompressed data

2021-09-0917:11:21

Google

osv.dev

0.007 Low

EPSS

Percentile

80.1%

JSON

Impact

The Bzip2 decompression decoder function doesn’t allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).

All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Workarounds

No workarounds other than not using the Bzip2Decoder

References

Relevant code areas:

https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305

CPENameOperatorVersion
io.netty:nettyeq3.5.0.Beta1
io.netty:netty-codeceq4.0.42.Final
io.netty:netty-codeceq4.0.37.Final
io.netty:netty-codeceq4.1.17.Final
io.netty:netty-codeceq4.1.0.Beta4
io.netty:netty-codeceq4.0.14.Final
io.netty:netty-codeceq4.0.0.Beta2
org.jboss.netty:nettyeq3.2.0.ALPHA2
io.netty:nettyeq3.5.2.Final
io.netty:nettyeq3.6.3.Final

Name	Operator	Version
io.netty:netty	eq	3.5.0.Beta1
io.netty:netty-codec	eq	4.0.42.Final
io.netty:netty-codec	eq	4.0.37.Final
io.netty:netty-codec	eq	4.1.17.Final
io.netty:netty-codec	eq	4.1.0.Beta4
io.netty:netty-codec	eq	4.0.14.Final
io.netty:netty-codec	eq	4.0.0.Beta2
org.jboss.netty:netty	eq	3.2.0.ALPHA2
io.netty:netty	eq	3.5.2.Final
io.netty:netty	eq	3.6.3.Final