CVE-2021-21419 (Medium) detected in eventlet-0.26.1-py2.py3-none-any.whl

[mend-bolt-for-github]

CVE-2021-21419 - Medium Severity Vulnerability

Vulnerable Library - eventlet-0.26.1-py2.py3-none-any.whl

Highly concurrent networking library

Library home page: https://files.pythonhosted.org/packages/c1/c8/b2193d5d1080baa540c74b0c3dad19e88ad1f523d1ef09e2e53ca725f6fb/eventlet-0.26.1-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ eventlet-0.26.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

Publish Date: 2021-05-07

URL: CVE-2021-21419

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9p9m-jm8w-94p2

Release Date: 2021-05-07

Fix Resolution: 0.31.0

---

Step up your Open Source Security Game with Mend here