CVE-2021-21419

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2021-21419
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-05-07 15:15:00 UTC
Updated2023-11-07 03:30:00 UTC
DescriptionEventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

Risk And Classification

Problem Types: CWE-400

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Eventlet Eventlet All All All All
Operating System Fedoraproject Fedora 33 All All All
Operating System Fedoraproject Fedora 34 All All All

References

ReferenceSourceLinkTags
[SECURITY] Fedora 34 Update: python-eventlet-0.31.0-1.fc34 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 33 Update: python-eventlet-0.31.0-1.fc33 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
[SECURITY] Fedora 33 Update: python-eventlet-0.31.0-1.fc33 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet · Advisory · eventlet/eventlet · GitHub CONFIRM github.com
[SECURITY] Fedora 34 Update: python-eventlet-0.31.0-1.fc34 - package-announce - Fedora Mailing-Lists FEDORA lists.fedoraproject.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 180062 Debian Security Update for python-eventlet (CVE-2021-21419)
  • 198374 Ubuntu Security Notification for Eventlet vulnerability (USN-4956-1)
  • 239525 Red Hat Update for OpenShift Container Platform 4.8.2 (RHSA-2021:2437)
  • 239943 Red Hat Update for OpenStack Platform 16.1 (RHSA-2021:5071)
  • 239946 Red Hat Update for OpenStack Platform 16.1
  • 239949 Red Hat Update for OpenStack Platform 16.1
  • 239952 Red Hat Update for OpenStack Platform 16.1
  • 239954 Red Hat Update for OpenStack Platform 16.1
  • 239958 Red Hat Update for OpenStack Platform 16.1
  • 281138 Fedora Security Update for python (FEDORA-2021-9fde3d7ab1)
  • 281139 Fedora Security Update for python (FEDORA-2021-d5915c247b)
  • 378004 Splunk Enterprise Multiple Vulnerabilities (SVD-2023-0215,SVD-2023-0211,SVD-2023-0208)
  • 770074 Red Hat OpenShift Container Platform 4.8 Security Update (RHSA-2021:2437)
  • 770111 Red Hat OpenShift Container Platform 4.8 Security Update (RHSA-2021-2437)
  • 980631 Python (pip) Security Update for eventlet (GHSA-9p9m-jm8w-94p2)
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report