The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-loggingUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hashieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-highlineUpgrade rubygem-ffi-debugsourceUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-clampUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-mime-types-dataUpgrade rubygem-little-pluggerUpgrade rubygem-unfUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade satellite-cloneUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-cliUpgrade rubygem-unf_extUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettext | Nov 17, 2022 | Oct 19, 2021 |
| Debian | — | Upgrade netty | Jan 13, 2023 | Oct 19, 2021 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 9, 2021 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 19, 2021 |
| Redhat_linux | — | Upgrade rubygem-powerbarUpgrade rubygem-unf_extUpgrade rubygem-hammer_cliUpgrade satellite-cloneUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debuginfoUpgrade rubygem-gssapiUpgrade rubygem-loggingUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-cookieUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unfUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-types-data | Nov 17, 2022 | Oct 19, 2021 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Oct 19, 2021 |
| Suse | — | Upgrade nettyUpgrade netty-javadocUpgrade netty-poms | Oct 26, 2022 | Oct 19, 2021 |
| Ubuntu | — | Upgrade libnetty-java (Ubuntu Pro)Upgrade libnetty-java | May 1, 2023 | Oct 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub