CVE-2021-21419

Description

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

How to fix CVE-2021-21419

To remediate CVE-2021-21419, upgrade the affected package to a fixed version below.

• —upgrade to 0.26.1-7 or later
• —upgrade to 0.31.0 or later
• —upgrade to 0.31.0 or later

Is CVE-2021-21419 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 0.26.1-7
• >= 0.10, < 0.31.0
• >= 0.10.0, < 0.31.0

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-21419
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-21419
• PATCHgithub.com/eventlet/eventlet
• WEBgithub.com/eventlet/eventlet/commit/1412f5e4125b4313f815778a1acb4d3336efcd07