CVE-2021-21419

Impact

A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame.

Patches

Version 0.31.0 restricts websocket frame to reasonable limits.

Workarounds

Restricting memory usage via OS limits would help against overall machine exhaustion. No workaround to protect Eventlet process.

For more information

If you have any questions or comments about this advisory:

• Open an issue in eventlet
• Contact current maintainers. At 2021-03: [email protected] or https://t.me/temotor

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

Updated python-eventlet packages fix a security vulnerability:

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process (CVE-2021-21419).

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema fixes the following issues:

Security fixes included on this update:

cassandra-kit:

• CVE-2020-17516: Internode encryption enforcement vulnerability

cassandra:

• CVE-2020-17516: Internode encryption enforcement vulnerability
• CVE-2017-5929 logback: Fixed a serialization vulnerability in SocketServer and ServerSocketReceiver

crowbar-core: CVE-2020-26247: Potentially XXE or SSRF attacks by parsed Nokogiri::XML::Schema

grafana:

• CVE-2021-27358: Unauthenticated remote attackers to trigger a Denial of Service via a remote API call

kibana:

• CVE-2017-11481: Fixed an XSS via URL fields
• CVE-2017-11499: Fixed a constant hashtable seeds vulnerability

python-Django:

• CVE-2021-28658: Potential directory-traversal via uploaded files
• CVE-2021-31542: Potential directory-traversal via uploaded files
• CVE-2021-33203: Potential directory traversal via admindocs
• CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
• CVE-2021-23336: Fixed web cache poisoning via django.utils.http.limited_parse_qsl

python-eventlet:

• CVE-2021-21419: Improper handling of highly compressed data and memory allocation with excessive size value

python-pysaml2:

• CVE-2021-21238: Fixed an improper verification of cryptographic signatures for signed SAML documents
• CVE-2021-21239: Fixed an improper verification of cryptographic signatures when using CryptoBackendXmlSec1()_

python-py:

• CVE-2020-29651: Regular expression denial of service in svnwc.py

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a hijack sessions by using timing attacks targeting the session id CVE-2019-16782

Non-security fixes included on this update:

Changes in ardana-cobbler:

• Update to version 8.0+git.1614096566.e8c2b27:
  • Change install_recommended to true (bsc#1181828)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)
• Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)
• Synchronize transaction logs for JBOD (CASSANDRA-16225)
• Fix the counting of cells per partition (CASSANDRA-16259)
• Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)
• Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)
• Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)
• Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)
• Remove the SEPExecutor blocking behavior (CASSANDRA-16186)
• Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)
• Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)
• Wait for schema agreement when bootstrapping (CASSANDRA-15158)
• Fix the histogram merge of the table metrics (CASSANDRA-16259)
• Synchronize Keyspace instance store/clear…

This update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma contains the following fixes:

Security fixes included in this update:

kibana: CVE-2021-22141: Fixed URL redirection flaw (bsc#1186868).

python-eventlet: CVE-2021-21419: Fixed improper handling of highly compressed data and memory allocation with excessive size value. (bsc#1185836)

rubygem-redcarpet: CVE-2020-26298: Fixed XSS via HTML escaping when processing quotes. (bsc#1180837)

rubygem-puma: CVE-2021-41136: Fixes build of the Java state machine for parsing HTTP. (bsc#1191681)

Non-security fixes included in this update:

Changes in ardana-ansible:

• Patch service.py to skip blank lines.

Changes in ardana-monasca:

• Use specific TLS versions for monasca-thresh DB connections. (SOC-11543)

Changes in crowbar-openstack:

• keystone wakeup: get new session on any error. (bsc#1189052)

Changes in influxdb:

• Set GO111MODULE=auto to fix build with go1.16 and later where default is GO111MODULE=on

Canges in kibana:

• Fix an open redirect flaw. (CVE-2021-22141, bsc#1186868)

Changes in openstack-cinder:

• Fix typo in Dell EMC Unity driver documentation.
• Drop lower-constraints job.
• [stable-only] Cap bandit to v1.6.2 and fix constraints.

Changes in openstack-ec2-api:

• Remove jobs corresponds to obselete featuresets.
• OpenDev Migration Patch.

Changes in openstack-heat-gbp:

• Add support for Wallaby.
• Fix upstream gate.

Changes in openstack-heat-templates:

• [ussuri][goal] Update contributor documentation.
• Fix zuul config for heat-templates-check.
• Remove testr.

Changes in openstack-horizon-plugin-gbp-ui:

• Add support for Wallaby.
• Fix upstream gate.

Changes in openstack-keystone:

• Retry update_user when sqlalchemy raises StaleDataErrors.
• Pin keystone-tempest-plugin for py27 compatibility.

Changes in openstack-neutron-gbp:

• Fix update router API.
• Fix HA IP DB migration.
• Revert 'Fix HA IP DB migration'.
• Fix HA IP DB migration.
• Add network_id column to apic_ml2_ha_ipaddress_to_port_owner table.
• Use custom converter for extra attributes.
• Validate network before creating or updating router.
• Fix Data Migration query for HA IP table.
• System security grp:Add system sg in port sg list.
• Add vrf column to apic_ml2_ha_ipaddress_to_port_owner table.
• [apic_aim]: Fix HA IP UTs.
• Fixing the exception msg for IPAddressGenerationFailure.
• Enhancement regarding router/instance attachment to an external network floating ip and snat subnets.
• Setting legacy-group-based-policy-dsvm-aim to non-voting gate.
• Add support for Wallaby.
• Bug fixes for gbp-validate.
• [apic_aim]: Filter endpoint details.
• Bugfix: Policy Enforcement Pref.
• Fix unit-tests for tenant-scope validation.
• [AIM] Add Policy Enforcement Pref to network extension.

Changes in openstack-nova:

• [neutron] Get only ID and name of the SGs from Neutron.
• Remove allocations before setting vm_status to SHELVED_OFFLOADED.
• libvirt:driver:Disallow AIO=native when 'O_DIRECT' is not available.
• Update pci stat pools based on PCI device changes.
• Use subqueryload() instead of joinedload() for (system_)metadata.

Changes in python-eventlet: Websocket: Limit maximum uncompressed frame length to 8MiB. (bsc#1185836 CVE-2021-21419)

It was discovered that Eventlet incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service.