CVE-2021-37137 - Denial of Service (DoS)

Abstract

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

The Oxygen XML products incorporates the Netty as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2021-37137

Severity: High

CVSS Score: 7.5

The Netty third-party library used by Oxygen XML software products is an affected version mentioned in CVE-2021-37137 vulnerability description. However, the Oxygen XML software products doesn't use Netty to decompress user-supplied Snappy data streams. Therefore Oxygen XML software products are not impacted by CVE-2021-37137.