{
  "threat_severity" : "Moderate",
  "public_date" : "2021-05-06T00:00:00Z",
  "bugzilla" : {
    "description" : "python-eventlet: improper handling of highly compressed data and memory allocation with excessive size allows DoS",
    "id" : "1958407",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1958407"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-400",
  "details" : [ "Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.", "A flaw was found in eventlet. If an unauthenticated user manages to send large websocket frames or highly compressed data frames that can lead to memory exhaustion. An attacker could use this flaw to cause a denial of service (DoS)." ],
  "statement" : "* In OpenShift Container Platform 4, the python-eventlet package is only used in Ironic container images, used for Baremetal provisioning, and Kuryr SDN container images, used for deployments on OpenStack.\n* In Red Hat Gluster Storage 3, python-eventlet package was primarily shipped as a dependency of openstack-swift. However, Openstack Swift is no longer supported with the recent release of Red Hat Gluster Storage 3.5.\n* Because the flaw's impact is lower and Red Hat OpenStack Platform 13 will be retiring soon, no update will be provided at this time for the RHOSP13 python-eventlet package.",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4.8",
    "release_date" : "2021-07-27T00:00:00Z",
    "advisory" : "RHSA-2021:2437",
    "cpe" : "cpe:/a:redhat:openshift:4.8::el8",
    "package" : "python-eventlet-0:0.25.2-4.el8"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.1",
    "release_date" : "2021-12-09T00:00:00Z",
    "advisory" : "RHSA-2021:5071",
    "cpe" : "cpe:/a:redhat:openstack:16.1::el8",
    "package" : "python-eventlet-0:0.25.2-5.el8ost.1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenStack Platform 10 (Newton)",
    "fix_state" : "Out of support scope",
    "package_name" : "python-eventlet",
    "cpe" : "cpe:/a:redhat:openstack:10"
  }, {
    "product_name" : "Red Hat OpenStack Platform 13 (Queens)",
    "fix_state" : "Will not fix",
    "package_name" : "python-eventlet",
    "cpe" : "cpe:/a:redhat:openstack:13"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "python-eventlet",
    "cpe" : "cpe:/a:redhat:storage:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-21419\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-21419" ],
  "name" : "CVE-2021-21419",
  "csaw" : false
}