The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-rest-clientUpgrade rubygem-netrcUpgrade rubygem-loggingUpgrade foreman-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-display_widthUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foremanUpgrade satellite-cloneUpgrade rubygem-amazing_printUpgrade rubygem-domain_nameUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-fast_gettextUpgrade satellite-cliUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_extUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade rubygem-ffiUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-types-dataUpgrade rubygem-locale | Nov 17, 2022 | Oct 19, 2021 |
| Debian | — | Upgrade netty | Jan 13, 2023 | Oct 19, 2021 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 9, 2021 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Oct 19, 2021 |
| Redhat_linux | — | Upgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade rubygem-unf_extUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicodeUpgrade satellite-cliUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-apipie-bindingsUpgrade rubygem-powerbarUpgrade rubygem-amazing_printUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffi-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade rubygem-ffiUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_templates | Nov 17, 2022 | Oct 19, 2021 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 12, 2024 | Oct 19, 2021 |
| Suse | — | Upgrade nettyUpgrade netty-pomsUpgrade netty-javadoc | Oct 26, 2022 | Oct 19, 2021 |
| Ubuntu | — | Upgrade libnetty-javaUpgrade libnetty-java (Ubuntu Pro) | May 1, 2023 | Oct 19, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub