CVE-2021-37136
- Source
- https://cve.org/CVERecord?id=CVE-2021-37136
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-37136.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-37136
- Aliases
- Downstream
CGA (18)
- CGA-34hg-gq8r-m6g3
- CGA-4vh7-8pmw-8wm9
- CGA-5hrg-84qv-5q5j
- CGA-7q86-g8f5-wphq
- CGA-98rh-wmjw-j5hh
- CGA-9w49-r3gc-rg29
- CGA-c78f-w7xw-f8wx
- CGA-g5px-83rr-hxmm
- CGA-gg5x-rmj9-85wx
- CGA-gm8g-4hhv-8r3m
- CGA-grpr-gwg6-p394
- CGA-hxfq-v5gq-5cw8
- CGA-j477-8p9w-6gf4
- CGA-jg9q-v499-x766
- CGA-p99p-jxjj-xgjh
- CGA-p9j8-266f-hp8f
- CGA-v2q5-vjr4-95mq
- CGA-vwc7-x9xh-7x9h
CLSA (7)
OESA (1)
openSUSE (1)
RLSA (1)
UBUNTU (1)
- Related
- Published
- 2021-10-19T15:15:07Z
- Modified
- 2026-09-23T03:45:20Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "fixed": "4.1.68" } ], "source": "CPE_RANGE", "vendor_product": "netty:netty" }, { "cpes": [ "cpe:2.3:a:oracle:banking_apis:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "18.1" }, { "last_affected": "18.3" } ], "source": "CPE_RANGE", "vendor_product": "oracle:banking_apis" }, { "cpes": [ "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "fixed": "12.0.0.4.6" } ], "source": "CPE_RANGE", "vendor_product": "oracle:communications_brm_-_elastic_charging_engine" }, { "cpes": [ "cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "8.0.0.0" }, { "last_affected": "8.5.0.2" } ], "source": "CPE_RANGE", "vendor_product": "oracle:communications_diameter_signaling_router" }, { "cpes": [ "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "10.0" }, { "last_affected": "10.0" }, { "introduced": "11.0" }, { "last_affected": "11.0" } ], "source": "CPE_STRING", "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "19.1" }, { "last_affected": "19.1" }, { "introduced": "19.2" }, { "last_affected": "19.2" }, { "introduced": "20.1" }, { "last_affected": "20.1" }, { "introduced": "21.1" }, { "last_affected": "21.1" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_apis" }, { "cpes": [ "cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "18.1" }, { "last_affected": "18.1" }, { "introduced": "18.2" }, { "last_affected": "18.2" }, { "introduced": "18.3" }, { "last_affected": "18.3" }, { "introduced": "19.1" }, { "last_affected": "19.1" }, { "introduced": "19.2" }, { "last_affected": "19.2" }, { "introduced": "20.1" }, { "last_affected": "20.1" }, { "introduced": "21.1" }, { "last_affected": "21.1" } ], "source": "CPE_STRING", "vendor_product": "oracle:banking_digital_experience" }, { "cpes": [ "cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" }, { "introduced": "14.1.1.0.0" }, { "last_affected": "14.1.1.0.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:coherence" }, { "cpes": [ "cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "11.3.2" }, { "last_affected": "11.3.2" } ], "source": "CPE_STRING", "vendor_product": "oracle:commerce_guided_search" }, { "cpes": [ "cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12:0.0.5.0:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12-0\\.0\\.5\\.0" }, { "last_affected": "12-0\\.0\\.5\\.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_brm_-_elastic_charging_engine" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.10.0" }, { "last_affected": "1.10.0" }, { "introduced": "1.11.0" }, { "last_affected": "1.11.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_cloud_native_core_binding_support_function" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.8.0" }, { "last_affected": "1.8.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_cloud_native_core_network_slice_selection_function" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.15.0" }, { "last_affected": "1.15.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_cloud_native_core_policy" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.7.0" }, { "last_affected": "1.7.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_cloud_native_core_security_edge_protection_proxy" }, { "cpes": [ "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.15.0" }, { "last_affected": "1.15.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_cloud_native_core_unified_data_repository" }, { "cpes": [ "cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "8.1" }, { "last_affected": "8.1" } ], "source": "CPE_STRING", "vendor_product": "oracle:communications_instant_messaging_server" }, { "cpes": [ "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.48:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "8.48" }, { "last_affected": "8.48" }, { "introduced": "8.57" }, { "last_affected": "8.57" }, { "introduced": "8.58" }, { "last_affected": "8.58" }, { "introduced": "8.59" }, { "last_affected": "8.59" } ], "source": "CPE_STRING", "vendor_product": "oracle:peoplesoft_enterprise_peopletools" }, { "cpes": [ "cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "12.2.1.3.0" }, { "last_affected": "12.2.1.3.0" }, { "introduced": "12.2.1.4.0" }, { "last_affected": "12.2.1.4.0" } ], "source": "CPE_STRING", "vendor_product": "oracle:webcenter_portal" } ] }- References
-
- https://lists.apache.org/thread.html/r06a145c9bd41a7344da242cef07977b24abe3349161ede948e30913d%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5406eaf3b07577d233b9f07cfc8f26e28369e6bab5edfcab41f28abb%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5e05eba32476c580412f9fbdfc9b8782d5b40558018ac4ac07192a04%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r75490c61c2cb7b6ae2c81238fd52ae13636c60435abcd732d41531a0%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rd262f59b1586a108e320e5c966feeafbb1b8cdc96965debc7cc10b16%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rfb2bf8597e53364ccab212fbcbb2a4e9f0a9e1429b1dc08023c6868e%40%3Cdev.tinkerpop.apache.org%3E
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20220210-0012/
- https://www.debian.org/security/2023/dsa-5316
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Affected packages
Git / github.com/helidon-io/helidon
Affected ranges
- Type
- GIT
- Repo
- https://github.com/helidon-io/helidon
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "cpe": [ "cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "1.4.10" }, { "last_affected": "1.4.10" }, { "introduced": "2.4.0" }, { "last_affected": "2.4.0" } ], "source": "CPE_STRING" }
Git / github.com/quarkusio/quarkus
Affected ranges
- Type
- GIT
- Repo
- https://github.com/quarkusio/quarkus
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "2.2.4" } ], "source": "CPE_RANGE" }