Bug 798114 (CVE-2021-21419)

Summary:	<dev-python/eventlet-0.31.0: memory exhaustion from websocket peer (CVE-2021-21419)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	mgorny, python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	794325
Bug Blocks:

Description John Helmert III archtester

2021-06-23 23:39:09 UTC

CVE-2021-21419 (https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2):

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.


Fix in 0.31.0, we'll just depend on the stablereq here.

Comment 1 NATTkA bot gentoo-dev

2021-07-29 17:21:26 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 2 NATTkA bot gentoo-dev

2021-07-29 17:29:35 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 3 NATTkA bot gentoo-dev

2021-07-29 17:37:33 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 4 NATTkA bot gentoo-dev

2021-07-29 17:45:38 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 5 NATTkA bot gentoo-dev

2021-07-29 17:53:43 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 6 NATTkA bot gentoo-dev

2021-07-29 18:01:36 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 7 NATTkA bot gentoo-dev

2021-07-29 18:09:58 UTC

Package list is empty or all packages have requested keywords.

Comment 8 Sam James archtester

2021-09-07 00:22:14 UTC

Please cleanup, thanks!

Comment 9 Michał Górny archtester

2021-09-07 07:10:28 UTC

done.

Comment 10 Larry the Git Cow gentoo-dev

2022-11-24 06:37:16 UTC

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2cae59c762dd22236d7aaec7e979b67e0c10d8a5

commit 2cae59c762dd22236d7aaec7e979b67e0c10d8a5
Author:     Jakov Smolić <jsmolic@gentoo.org>
AuthorDate: 2022-11-24 06:32:09 +0000
Commit:     Jakov Smolić <jsmolic@gentoo.org>
CommitDate: 2022-11-24 06:36:44 +0000

    dev-python/eventlet: treeclean
    
    Closes: https://bugs.gentoo.org/845723
    Closes: https://bugs.gentoo.org/865499
    Closes: https://bugs.gentoo.org/827876
    Closes: https://bugs.gentoo.org/797586
    Closes: https://bugs.gentoo.org/798114
    Signed-off-by: Jakov Smolić <jsmolic@gentoo.org>

 dev-python/eventlet/Manifest                       |  1 -
 dev-python/eventlet/eventlet-0.33.1.ebuild         | 63 ----------------------
 .../eventlet/files/eventlet-0.25.1-tests.patch     | 40 --------------
 .../files/eventlet-0.30.0-tests-socket.patch       | 13 -----
 .../files/eventlet-0.30.2-test-timeout.patch       | 39 --------------
 dev-python/eventlet/metadata.xml                   | 12 -----
 profiles/package.mask                              |  7 ---
 7 files changed, 175 deletions(-)