Vulnerability PYSEC-2021-12
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 years ago
May 07, 2021 at 03:15 PM UTC
No summary available
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3
Details
Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
4 months ago
Potential DoS via the Tudoor mechanism in eventlet and dnspython
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 PYSEC-2026-2472
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 PYSEC-2026-2472
Unknown
4 months ago
Eventlet affected by HTTP request smuggling in unparsed trailers
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 PYSEC-2026-1350
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 PYSEC-2026-1350
Medium Risk
1 year ago
Eventlet affected by HTTP request smuggling in unparsed trailers
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 GHSA-hw6f-rjfj-j7j7
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.40.2 GHSA-hw6f-rjfj-j7j7
Medium Risk
2 years ago
Potential DoS via the Tudoor mechanism in eventlet and dnspython
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 GHSA-3rq5-2g8h-59hc
0.2 and 0.5.3 and 0.6.1 and 0.7 and 0.8 and 0.8.16 and 0.9.17 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.33.3 and 0.34.1 - 0.35.1 GHSA-3rq5-2g8h-59hc
Medium Risk
5 years ago
Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3 GHSA-9p9m-jm8w-94p2
0.10.0 - 0.11.0 and 0.12.1 - 0.14.0 and 0.15.2 and 0.16.1 and 0.17.4 and 0.18.2 - 0.30.3 GHSA-9p9m-jm8w-94p2
Impacted packages
Timeline
Published
5 years ago
May 07, 2021 at 03:15 PM UTC
Fixed (0.31.0)
5 years ago
May 05, 2021 at 02:29 PM UTC
Last Modified
3 years ago
November 08, 2023 at 04:04 AM UTC