CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2021-37136

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

Score
7.5 high
Published
2021-10-19
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
java/nettynetty4.1.53_2unaddressedglewis@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.68</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Bzip2 decompression decoder function doesn't allow setting size
	restrictions on the decompressed output data (which affects the
	allocation size used during decompression). All users of Bzip2Decoder
	are affected. The malicious input can trigger an OOME and so a DoS
	attack</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-37136</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-37136</url>
    </references>
    <dates>
      <discovery>2021-10-19</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>