Homepage

Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package python-eventlet  (opens in a new tab)

Threat Intelligence

EPSS
1.79% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-PYTHONEVENTLET-5395015
  • published26 Mar 2023
  • disclosed6 May 2021
Report a new vulnerability Found a mistake?

Introduced: 6 May 2021

CVE-2021-21419  (opens in a new tab)
CWE-400  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-eventlet package and not the python-eventlet package as distributed by RHEL.

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.