CVE-2021-21419

WebSocket frame memory exhaustion vulnerability in Eventlet

• CVSS 5.3
• CWE-400 Uncontrolled Resource Consumption
• Resource Management
• Remote

Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.

CVE

CVE-2021-21419

CWE

CWE-400 Uncontrolled Resource Consumption

CVSS base score

5.3

Published

2021-05-07

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Eventlet to version 0.31.0 or higher.

import eventlet
from eventlet import wsgi
from eventlet.green import websocket

class MyWebSocketHandler(websocket.WebSocketWSGI):
    def on_message(self, message):
        print("Received message:", message)

def application(environ, start_response):
    if environ['PATH_INFO'] == '/ws':
        return MyWebSocketHandler(environ, start_response)
    start_response('404 Not Found', [])
    return []

wsgi.server(eventlet.listen(('0.0.0.0', 8000)), application)

import eventlet
from eventlet import wsgi
from eventlet.green import websocket

MAX_FRAME_SIZE = 1024 * 1024

class MyWebSocketHandler(websocket.WebSocketWSGI):
    def on_message(self, message):
        if len(message) > MAX_FRAME_SIZE:
            self.close()
            return
        print("Received message:", message)

def application(environ, start_response):
    if environ['PATH_INFO'] == '/ws':
        return MyWebSocketHandler(environ, start_response)
    start_response('404 Not Found', [])
    return []

wsgi.server(eventlet.listen(('0.0.0.0', 8000)), application)

@misc{vaitp:cve202121419,
  title        = {{WebSocket frame memory exhaustion vulnerability in Eventlet}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-21419},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-21419/}}
}