Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 798114 (CVE-2021-21419) - <dev-python/eventlet-0.31.0: memory exhaustion from websocket peer (CVE-2021-21419)
Summary: <dev-python/eventlet-0.31.0: memory exhaustion from websocket peer (CVE-2021-...
Status: RESOLVED FIXED
Alias: CVE-2021-21419
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa]
Keywords:
Depends on: 794325
Blocks:
  Show dependency tree
 
Reported: 2021-06-23 23:39 UTC by John Helmert III
Modified: 2022-11-24 15:01 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-06-23 23:39:09 UTC 
CVE-2021-21419 (https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2):

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.


Fix in 0.31.0, we'll just depend on the stablereq here.
Comment 1 NATTkA bot gentoo-dev 2021-07-29 17:21:26 UTC Comment hidden (obsolete)
Comment 2 NATTkA bot gentoo-dev 2021-07-29 17:29:35 UTC Comment hidden (obsolete)
Comment 3 NATTkA bot gentoo-dev 2021-07-29 17:37:33 UTC Comment hidden (obsolete)
Comment 4 NATTkA bot gentoo-dev 2021-07-29 17:45:38 UTC Comment hidden (obsolete)
Comment 5 NATTkA bot gentoo-dev 2021-07-29 17:53:43 UTC Comment hidden (obsolete)
Comment 6 NATTkA bot gentoo-dev 2021-07-29 18:01:36 UTC Comment hidden (obsolete)
Comment 7 NATTkA bot gentoo-dev 2021-07-29 18:09:58 UTC 
Package list is empty or all packages have requested keywords.
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-09-07 00:22:14 UTC 
Please cleanup, thanks!
Comment 9 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2021-09-07 07:10:28 UTC 
done.
Comment 10 Larry the Git Cow gentoo-dev 2022-11-24 06:37:16 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2cae59c762dd22236d7aaec7e979b67e0c10d8a5

commit 2cae59c762dd22236d7aaec7e979b67e0c10d8a5
Author:     Jakov Smolić <jsmolic@gentoo.org>
AuthorDate: 2022-11-24 06:32:09 +0000
Commit:     Jakov Smolić <jsmolic@gentoo.org>
CommitDate: 2022-11-24 06:36:44 +0000

    dev-python/eventlet: treeclean
    
    Closes: https://bugs.gentoo.org/845723
    Closes: https://bugs.gentoo.org/865499
    Closes: https://bugs.gentoo.org/827876
    Closes: https://bugs.gentoo.org/797586
    Closes: https://bugs.gentoo.org/798114
    Signed-off-by: Jakov Smolić <jsmolic@gentoo.org>

 dev-python/eventlet/Manifest                       |  1 -
 dev-python/eventlet/eventlet-0.33.1.ebuild         | 63 ----------------------
 .../eventlet/files/eventlet-0.25.1-tests.patch     | 40 --------------
 .../files/eventlet-0.30.0-tests-socket.patch       | 13 -----
 .../files/eventlet-0.30.2-test-timeout.patch       | 39 --------------
 dev-python/eventlet/metadata.xml                   | 12 -----
 profiles/package.mask                              |  7 ---
 7 files changed, 175 deletions(-)