The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade python39-pulp_manifestUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicodeUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_extUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-loggingUpgrade rubygem-amazing_printUpgrade rubygem-clampUpgrade rubygem-jwtUpgrade rubygem-ffi-debuginfoUpgrade rubygem-highlineUpgrade satellite-cloneUpgrade rubygem-little-pluggerUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hashieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-oauthUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cliUpgrade foreman-cliUpgrade rubygem-localeUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_tasks | Nov 17, 2022 | Oct 19, 2021 |
| Debian | — | Upgrade netty | Jan 13, 2023 | Oct 19, 2021 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 9, 2021 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 19, 2021 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade python39-pulp_manifestUpgrade rubygem-mime-typesUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-domain_nameUpgrade rubygem-unicodeUpgrade rubygem-netrcUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debuginfoUpgrade satellite-cloneUpgrade rubygem-unf_extUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-loggingUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-jwtUpgrade rubygem-gssapiUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-localeUpgrade rubygem-oauthUpgrade rubygem-amazing_print | Nov 17, 2022 | Oct 19, 2021 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Oct 19, 2021 |
| Suse | — | Upgrade netty-javadocUpgrade netty-pomsUpgrade netty | Oct 26, 2022 | Oct 19, 2021 |
| Ubuntu | — | Upgrade libnetty-javaUpgrade libnetty-java (Ubuntu Pro) | May 1, 2023 | Oct 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub