Sign-up

ID

VAR-202110-1705


CVE

CVE-2021-37137


TITLE

Netty  Resource exhaustion vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-013841

DESCRIPTION

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. Netty Exists in a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. Solution: For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html For Red Hat OpenShift Logging 5.3, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html 4. JIRA issues fixed (https://issues.jboss.org/): LOG-2334 - [release-5.3] Events listing out of order in Kibana 6.8.1 LOG-2450 - http.max_header_size set to 128kb causes communication with elasticsearch to stop working LOG-2481 - EO shouldn't grant cluster-wide permission to system:serviceaccount:openshift-monitoring:prometheus-k8s when ES cluster is deployed. [openshift-logging 5.3] 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5316-1 security@debian.org https://www.debian.org/security/ Markus Koschany January 11, 2023 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : netty CVE ID : CVE-2021-37136 CVE-2021-37137 CVE-2021-43797 CVE-2022-41881 CVE-2022-41915 Debian Bug : 1027180 1014769 1001437 Several out-of-memory, stack overflow or HTTP request smuggling vulnerabilities have been discovered in Netty, a Java NIO client/server socket framework, which may allow attackers to cause a denial of service or bypass restrictions when used as a proxy. For the stable distribution (bullseye), these problems have been fixed in version 1:4.1.48-4+deb11u1. We recommend that you upgrade your netty packages. For the detailed security status of netty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/netty Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmO/OTVfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7 UeREBA//QmQrVlx87/n7z5FISY20tNkSxAI3/Xqx9IB/ldRLUw8xcttHoDV13H4K JFKuEP6bdZzdzxXCcYGqNlXPjMJqbH6KIEmjIbCthsnbQfNzSXm86eqeZWl33kEG QA1buF47PeyRzuW93JmS+XpjjOWaXA4/MmP14wOqHyu/sorRc4aN5R0/ea+cUSW4 a7Zvb/m/gM5dLm1m88do5oBgJsynZM0fCfLi/Lz2vvSKKap/DJaCcK9sjvyzCRlb 8OqtE+B5eejUIGcBF2TD5BZiZLY5ZIqPBEUZO5g+WMnPRWNUaU/lYqKuTPPlU72A ZUeysGlAyhbPueEd5cIXG7jYUt07VRUFixinXHukhErzWtQU28mY7mA50If+wabO 9Pj/6/76St0XFWWxRNPYFCXeM7oSNdvC8DA7oNahpBMDSP/bJSc+sDdwjp41PjKj zKKHraQMtOCDOWmqeWJUfUdqVa2ptSjUZ/oGBsW4CUkesoS03YAAtGasxlpfhR2o 43V0e7/9YmiBI1ZkpqIZ4vU7siqE6NzCMmvdtYaTQD66P0CJ3FCC/OdSdKSRp0HN Z45D6hUUZdJLJrO8gGfLfZo9aABTlOSuRUcdHLBqOVUUjz7wqlQHH2d63ytf9X93 ATsBST3G5fY5ssKcyxHFtDAsqgbokkCLJ0D7TFM4cY+E7ywpq+I= =jx2O -----END PGP SIGNATURE----- . JIRA issues fixed (https://issues.redhat.com/): ENTMQST-5081 - [PROD] Create RHSA erratum for Streams 2.5.0 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat build of Quarkus 2.2.5 release and security update Advisory ID: RHSA-2022:0589-01 Product: Red Hat build of Quarkus Advisory URL: https://access.redhat.com/errata/RHSA-2022:0589 Issue date: 2022-02-21 CVE Names: CVE-2021-2471 CVE-2021-4178 CVE-2021-28170 CVE-2021-37136 CVE-2021-37137 CVE-2021-37714 CVE-2021-38153 CVE-2021-41269 ===================================================================== 1. Summary: An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section. 2. Description: This release of Red Hat build of Quarkus 2.2.5 includes security updates, bug fixes, and enhancements. For more information, see the release notes page listed in the References section. Security Fix(es): * kafka-clients: Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients (CVE-2021-38153) * kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178) * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714) * jakarta.el: jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170) * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136) * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137) * mysql-connector-java: unauthorized access to critical (CVE-2021-2471) * cron-utils: template Injection leading to unauthenticated Remote Code Execution(CVE-2021-41269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate 1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2009041 - CVE-2021-38153 Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients 2020583 - CVE-2021-2471 mysql-connector-java: unauthorized access to critical 2024632 - CVE-2021-41269 cron-utils: template Injection leading to unauthenticated Remote Code Execution 2034388 - CVE-2021-4178 kubernetes-client: Insecure deserialization in unmarshalYaml method 5. References: https://access.redhat.com/security/cve/CVE-2021-2471 https://access.redhat.com/security/cve/CVE-2021-4178 https://access.redhat.com/security/cve/CVE-2021-28170 https://access.redhat.com/security/cve/CVE-2021-37136 https://access.redhat.com/security/cve/CVE-2021-37137 https://access.redhat.com/security/cve/CVE-2021-37714 https://access.redhat.com/security/cve/CVE-2021-38153 https://access.redhat.com/security/cve/CVE-2021-41269 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus&downloadType=distributions&version=2.2.5 https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/2.2/ https://access.redhat.com/articles/4966181 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYhQOfNzjgjWX9erEAQjzdA//ddK6hPPLHj5/ubtY1ZS19bIEy5ZcgL45 hY7P1HWdqs+UDXnSMLlgXoDMc+qJNmJ9EkEzY4xNkpqc3WMjVgBsZ6t1wjVhIFxt dKV1Vj3wwyQJhbbbcxLPhfeJW33hVYNcOWPqlbX4+qnc11slQVIsH2RN0qltP0OA 5LyNjj39lobMoSWxn4T65iexONA6edYcDWrQQrMSLw/xa/w+xMEOL1Dg+LYsJtFp XPAovAstep1haAAtv6fqTOdmMAZpFVgrzsi/GhrLRS23Q5O3HvTZIWgl+wDVghH1 WuniWLADJ4//X7fibrSq0QCLDpSQ0xc+RInrKfc6gczw1wNbgUoO2ITrzvjeHTx2 7udXXpXlif6uaKPGdDVqfu/LO8GO0q24nQcWav8gI2hksq5QDz6c3PjclJBECGGI c4jtGAdENlAlK0p7yOgdoByq4VSYt26tMIKQLsvgVUSEEP/xi65FJDl4pEJNNmqM i2OlMntKYWjEPuX513CWE3A/ZZzteHmksfP/VgPnJ+vh3JMHjvfpGsnCu9WZI2j4 00DQsIOcUZ43DnldJY6pYrkN04JgXjYkyTAH3+vJac4ylU7HqyzyqhucVRQWqp4o xREFsOy4oxpGyxCpywZCpoZRlGemLCtOh5KTCRKzRrNYZf2dmSo/MIYhPF02dySH gtC/1OCBcZs= =l9VG -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Description: Red Hat AMQ Streams, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency

Trust: 2.34

sources: NVD: CVE-2021-37137 // JVNDB: JVNDB-2021-013841 // VULHUB: VHN-398973 // VULMON: CVE-2021-37137 // PACKETSTORM: 167140 // PACKETSTORM: 167122 // PACKETSTORM: 170498 // PACKETSTORM: 174675 // PACKETSTORM: 166093 // PACKETSTORM: 165564

AFFECTED PRODUCTS

vendor:oraclemodel:banking digital experiencescope:eqversion:18.2

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:20.1

Trust: 1.0

vendor:oraclemodel:banking apisscope:eqversion:20.1

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:lteversion:8.5.0.2

Trust: 1.0

vendor:nettymodel:nettyscope:ltversion:4.1.68

Trust: 1.0

vendor:oraclemodel:communications diameter signaling routerscope:gteversion:8.0.0.0

Trust: 1.0

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.57

Trust: 1.0

vendor:oraclemodel:communications brm - elastic charging enginescope:ltversion:12.0.0.4.6

Trust: 1.0

vendor:oraclemodel:webcenter portalscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:oraclemodel:commerce guided searchscope:eqversion:11.3.2

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:oraclemodel:banking apisscope:lteversion:18.3

Trust: 1.0

vendor:oraclemodel:communications cloud native core binding support functionscope:eqversion:1.10.0

Trust: 1.0

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.58

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.3

Trust: 1.0

vendor:quarkusmodel:quarkusscope:ltversion:2.2.4

Trust: 1.0

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.59

Trust: 1.0

vendor:oraclemodel:banking apisscope:eqversion:19.1

Trust: 1.0

vendor:oraclemodel:banking apisscope:gteversion:18.1

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:19.1

Trust: 1.0

vendor:oraclemodel:communications brm - elastic charging enginescope:eqversion:12.0.0.5.0

Trust: 1.0

vendor:netappmodel:oncommand insightscope:eqversion: -

Trust: 1.0

vendor:oraclemodel:webcenter portalscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:19.2

Trust: 1.0

vendor:oraclemodel:banking apisscope:eqversion:19.2

Trust: 1.0

vendor:oraclemodel:banking apisscope:eqversion:21.1

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:18.1

Trust: 1.0

vendor:oraclemodel:banking digital experiencescope:eqversion:21.1

Trust: 1.0

vendor:オラクルmodel:oracle communications cloud native core binding support functionscope: - version: -

Trust: 0.8

vendor:netappmodel:oncommand insightscope: - version: -

Trust: 0.8

vendor:オラクルmodel:oracle banking apisscope: - version: -

Trust: 0.8

vendor:オラクルmodel:oracle commerce guided searchscope: - version: -

Trust: 0.8

vendor:オラクルmodel:oracle banking digital experiencescope: - version: -

Trust: 0.8

vendor:the nettymodel:nettyscope: - version: -

Trust: 0.8

vendor:オラクルmodel:peoplesoft enterprise peopletoolsscope: - version: -

Trust: 0.8

vendor:オラクルmodel:oracle communications diameter signaling routerscope: - version: -

Trust: 0.8

vendor:quarkusmodel:quarkusscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-013841 // NVD: CVE-2021-37137

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37137
value: HIGH

Trust: 1.0

NVD: CVE-2021-37137
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202110-1441
value: HIGH

Trust: 0.6

VULHUB: VHN-398973
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-37137
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-37137
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-398973
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-37137
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-37137
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-398973 // VULMON: CVE-2021-37137 // JVNDB: JVNDB-2021-013841 // CNNVD: CNNVD-202110-1441 // NVD: CVE-2021-37137

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.1

problemtype:Resource exhaustion (CWE-400) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-398973 // JVNDB: JVNDB-2021-013841 // NVD: CVE-2021-37137

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202110-1441

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202110-1441

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-398973

PATCH
title:Oracle Critical Patch Update Advisory - April 2022 Oracle Critical Patch Updateurl:https://security.netapp.com/advisory/ntap-20220210-0012/
Trust: 0.8
title:Netty Remediation of resource management error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=167343
Trust: 0.6
title:Debian CVElist Bug Report Logs: netty: CVE-2021-37136 CVE-2021-37137url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=a5e38370f40726b133030c0594fe8664
Trust: 0.1
title:Red Hat: Moderate: Red Hat build of Quarkus 2.2.5 release and security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220589 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat Process Automation Manager 7.13.0 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20225903 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat JBoss Enterprise Application Platform 7.4.5 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20224922 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20224919 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20221013 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat OpenShift Logging Security and Bug update Release 5.4.1url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20222216 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat OpenShift Logging Security and Bug update Release 5.3.7url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20222217 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20224918 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Openshift Logging Security and Bug update Release (5.2.10)url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20222218 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat Data Grid 8.3.0 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20220520 - Security Advisory
Trust: 0.1
title:IBM: Security Bulletin: IBM Sterling Order Management Netty 4.1.34 vulnerablityurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=af77dc87872bf8291f2ffc3efc5cd87f
Trust: 0.1
title:Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Common Servicesurl:https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories&qid=hitachi-sec-2022-115
Trust: 0.1
sources:
            
            
            VULMON: CVE-2021-37137 // 
            
            
            
            JVNDB: JVNDB-2021-013841 // 
            
            
            
            CNNVD: CNNVD-202110-1441

EXTERNAL IDS
db:NVDid:CVE-2021-37137
Trust: 4.0
db:PACKETSTORMid:170498
Trust: 0.8
db:PACKETSTORMid:165564
Trust: 0.8
db:JVNDBid:JVNDB-2021-013841
Trust: 0.8
db:PACKETSTORMid:166408
Trust: 0.7
db:PACKETSTORMid:169918
Trust: 0.7
db:PACKETSTORMid:167142
Trust: 0.7
db:PACKETSTORMid:164936
Trust: 0.7
db:PACKETSTORMid:168657
Trust: 0.7
db:PACKETSTORMid:165980
Trust: 0.7
db:PACKETSTORMid:165105
Trust: 0.7
db:PACKETSTORMid:167423
Trust: 0.7
db:PACKETSTORMid:167964
Trust: 0.7
db:PACKETSTORMid:166093
Trust: 0.7
db:AUSCERTid:ESB-2022.5013
Trust: 0.6
db:AUSCERTid:ESB-2022.5422
Trust: 0.6
db:AUSCERTid:ESB-2021.4029
Trust: 0.6
db:AUSCERTid:ESB-2022.0747
Trust: 0.6
db:AUSCERTid:ESB-2022.5991
Trust: 0.6
db:AUSCERTid:ESB-2023.0168
Trust: 0.6
db:AUSCERTid:ESB-2022.0195
Trust: 0.6
db:AUSCERTid:ESB-2021.4253
Trust: 0.6
db:AUSCERTid:ESB-2022.0644
Trust: 0.6
db:AUSCERTid:ESB-2021.3847
Trust: 0.6
db:AUSCERTid:ESB-2021.4229
Trust: 0.6
db:AUSCERTid:ESB-2022.3870
Trust: 0.6
db:AUSCERTid:ESB-2022.2799
Trust: 0.6
db:CS-HELPid:SB2022012310
Trust: 0.6
db:CS-HELPid:SB2022012753
Trust: 0.6
db:CS-HELPid:SB2022060838
Trust: 0.6
db:CS-HELPid:SB2022042284
Trust: 0.6
db:CS-HELPid:SB2022051235
Trust: 0.6
db:CNNVDid:CNNVD-202110-1441
Trust: 0.6
db:PACKETSTORMid:167122
Trust: 0.2
db:PACKETSTORMid:167140
Trust: 0.2
db:PACKETSTORMid:167424
Trust: 0.1
db:PACKETSTORMid:167422
Trust: 0.1
db:VULHUBid:VHN-398973
Trust: 0.1
db:VULMONid:CVE-2021-37137
Trust: 0.1
db:PACKETSTORMid:174675
Trust: 0.1
sources:
            
            
            VULHUB: VHN-398973 // 
            
            
            
            VULMON: CVE-2021-37137 // 
            
            
            
            JVNDB: JVNDB-2021-013841 // 
            
            
            
            PACKETSTORM: 167140 // 
            
            
            
            PACKETSTORM: 167122 // 
            
            
            
            PACKETSTORM: 170498 // 
            
            
            
            PACKETSTORM: 174675 // 
            
            
            
            PACKETSTORM: 166093 // 
            
            
            
            PACKETSTORM: 165564 // 
            
            
            
            CNNVD: CNNVD-202110-1441 // 
            
            
            
            NVD: CVE-2021-37137

REFERENCES
url:https://www.oracle.com/security-alerts/cpuapr2022.html
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2021-37137
Trust: 2.0
url:https://security.netapp.com/advisory/ntap-20220210-0012/
Trust: 1.8
url:https://github.com/netty/netty/security/advisories/ghsa-9vjp-v76f-g363
Trust: 1.8
url:https://www.oracle.com/security-alerts/cpujan2022.html
Trust: 1.8
url:https://www.oracle.com/security-alerts/cpujul2022.html
Trust: 1.8
url:https://www.debian.org/security/2023/dsa-5316
Trust: 1.7
url:https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
Trust: 1.7
url:https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3ccommits.druid.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3ccommits.druid.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3ccommits.druid.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3ccommits.druid.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3ccommits.druid.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3cdev.tinkerpop.apache.org%3e
Trust: 1.0
url:https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04@%3ccommits.druid.apache.org%3e
Trust: 0.8
url:https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb@%3ccommits.druid.apache.org%3e
Trust: 0.8
url:https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0@%3ccommits.druid.apache.org%3e
Trust: 0.8
url:https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d@%3ccommits.druid.apache.org%3e
Trust: 0.8
url:https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16@%3ccommits.druid.apache.org%3e
Trust: 0.8
url:https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e@%3cdev.tinkerpop.apache.org%3e
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2021-37136
Trust: 0.6
url:https://www.ibm.com/support/pages/node/6522822
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022042284
Trust: 0.6
url:https://vigilance.fr/vulnerability/oracle-communications-vulnerabilities-of-january-2022-37289
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.3847
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022012753
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4029
Trust: 0.6
url:https://packetstormsecurity.com/files/170498/debian-security-advisory-5316-1.html
Trust: 0.6
url:https://packetstormsecurity.com/files/168657/red-hat-security-advisory-2022-6835-01.html
Trust: 0.6
url:https://packetstormsecurity.com/files/165980/red-hat-security-advisory-2022-0520-01.html
Trust: 0.6
url:https://vigilance.fr/vulnerability/netty-codec-overload-via-snappyframedecoder-38515
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5422
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022012310
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.2799
Trust: 0.6
url:https://packetstormsecurity.com/files/165564/red-hat-security-advisory-2022-0138-06.html
Trust: 0.6
url:https://packetstormsecurity.com/files/167423/red-hat-security-advisory-2022-4918-01.html
Trust: 0.6
url:https://www.ibm.com/support/pages/node/6523820
Trust: 0.6
url:https://packetstormsecurity.com/files/167142/red-hat-security-advisory-2022-2216-01.html
Trust: 0.6
url:https://packetstormsecurity.com/files/165105/red-hat-security-advisory-2021-4851-01.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0195
Trust: 0.6
url:https://packetstormsecurity.com/files/167964/red-hat-security-advisory-2022-5903-01.html
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022060838
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2023.0168
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4229
Trust: 0.6
url:https://packetstormsecurity.com/files/166408/red-hat-security-advisory-2022-1013-01.html
Trust: 0.6
url:https://packetstormsecurity.com/files/166093/red-hat-security-advisory-2022-0589-01.html
Trust: 0.6
url:https://packetstormsecurity.com/files/164936/red-hat-security-advisory-2021-3959-01.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2021.4253
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5991
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.3870
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.5013
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0747
Trust: 0.6
url:https://packetstormsecurity.com/files/169918/red-hat-security-advisory-2022-8506-01.html
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022051235
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0644
Trust: 0.6
url:https://access.redhat.com/security/team/contact/
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2021-37137
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2021-37136
Trust: 0.5
url:https://bugzilla.redhat.com/):
Trust: 0.5
url:https://listman.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.5
url:https://access.redhat.com/security/updates/classification/#moderate
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2021-43797
Trust: 0.3
url:https://issues.jboss.org/):
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-0759
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-21426
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-21443
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-21476
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-1154
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-21496
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-1154
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2021-43797
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-21698
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-21496
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-25636
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-25636
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-21434
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2021-4028
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-21443
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-21434
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-0778
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2018-25032
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-25032
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2021-4028
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-21426
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-21476
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-0778
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-0759
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-21698
Trust: 0.2
url:https://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2022-1271
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2022-1271
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2021-38153
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2021-38153
Trust: 0.2
url:https://cwe.mitre.org/data/definitions/400.html
Trust: 0.1
url:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014769
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-order-management-netty-4-1-34-vulnerablity-2/
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:2218
Trust: 0.1
url:https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html
Trust: 0.1
url:https://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:2217
Trust: 0.1
url:https://security-tracker.debian.org/tracker/netty
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-41881
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-41915
Trust: 0.1
url:https://www.debian.org/security/
Trust: 0.1
url:https://www.debian.org/security/faq
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-34455
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-34455
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-3635
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2022-36944
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2022-1471
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-2976
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-34462
Trust: 0.1
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-2976
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-26048
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-34454
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2023:5165
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-0482
Trust: 0.1
url:https://access.redhat.com/documentation/en-us/red_hat_amq_streams/2.5
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-24823
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-34454
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-1471
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2022-36944
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2022-24823
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-26048
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-34453
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-33201
Trust: 0.1
url:https://issues.redhat.com/):
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-33201
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-26049
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-26049
Trust: 0.1
url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.amq.streams&version=2.5.0
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-34462
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2023-0482
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2023-34453
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-4178
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-37714
Trust: 0.1
url:https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/2.2/
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-37714
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-2471
Trust: 0.1
url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=redhat.quarkus&downloadtype=distributions&version=2.2.5
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-4178
Trust: 0.1
url:https://access.redhat.com/articles/4966181
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-2471
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-28170
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-41269
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-28170
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:0589
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-41269
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-44832
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-44832
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2021-34429
Trust: 0.1
url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=jboss.amq.streams&version=2.0.0
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2021-34429
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2022:0138
Trust: 0.1
sources:
            
            
            VULHUB: VHN-398973 // 
            
            
            
            VULMON: CVE-2021-37137 // 
            
            
            
            JVNDB: JVNDB-2021-013841 // 
            
            
            
            PACKETSTORM: 167140 // 
            
            
            
            PACKETSTORM: 167122 // 
            
            
            
            PACKETSTORM: 170498 // 
            
            
            
            PACKETSTORM: 174675 // 
            
            
            
            PACKETSTORM: 166093 // 
            
            
            
            PACKETSTORM: 165564 // 
            
            
            
            CNNVD: CNNVD-202110-1441 // 
            
            
            
            NVD: CVE-2021-37137

CREDITS
Red Hat
Trust: 0.5
sources:
            
            
            PACKETSTORM: 167140 // 
            
            
            
            PACKETSTORM: 167122 // 
            
            
            
            PACKETSTORM: 174675 // 
            
            
            
            PACKETSTORM: 166093 // 
            
            
            
            PACKETSTORM: 165564

SOURCES
db:VULHUBid:VHN-398973
db:VULMONid:CVE-2021-37137
db:JVNDBid:JVNDB-2021-013841
db:PACKETSTORMid:167140
db:PACKETSTORMid:167122
db:PACKETSTORMid:170498
db:PACKETSTORMid:174675
db:PACKETSTORMid:166093
db:PACKETSTORMid:165564
db:CNNVDid:CNNVD-202110-1441
db:NVDid:CVE-2021-37137

LAST UPDATE DATE
2024-12-21T22:21:01.858000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-398973date:2023-02-24T00:00:00
db:VULMONid:CVE-2021-37137date:2022-10-05T00:00:00
db:JVNDBid:JVNDB-2021-013841date:2022-09-28T08:33:00
db:CNNVDid:CNNVD-202110-1441date:2023-01-16T00:00:00
db:NVDid:CVE-2021-37137date:2023-11-07T03:36:54.510

SOURCES RELEASE DATE
db:VULHUBid:VHN-398973date:2021-10-19T00:00:00
db:VULMONid:CVE-2021-37137date:2021-10-19T00:00:00
db:JVNDBid:JVNDB-2021-013841date:2022-09-28T00:00:00
db:PACKETSTORMid:167140date:2022-05-12T15:53:27
db:PACKETSTORMid:167122date:2022-05-12T15:38:35
db:PACKETSTORMid:170498date:2023-01-12T15:16:09
db:PACKETSTORMid:174675date:2023-09-15T13:53:16
db:PACKETSTORMid:166093date:2022-02-22T16:52:49
db:PACKETSTORMid:165564date:2022-01-14T15:29:02
db:CNNVDid:CNNVD-202110-1441date:2021-10-19T00:00:00
db:NVDid:CVE-2021-37137date:2021-10-19T15:15:07.757