CVE-2021-22553 : Security Advisory and Response
Learn about the impact and technical details of CVE-2021-22553, a vulnerability in Gerrit causing heap memory exhaustion. Find mitigation steps and best practices to secure your system.
Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.
Understanding CVE-2021-22553
This vulnerability in Gerrit, affecting versions less than 2.15.22, 2.16.26, 3.0.16, 3.1.12, 3.2.7, and 3.3.2, allows for heap memory exhaustion due to the lack of session expiration in Jetty.
What is CVE-2021-22553?
CVE-2021-22553 is a vulnerability in Gerrit that can lead to heap memory exhaustion on servers, impacting the availability of the system.
The Impact of CVE-2021-22553
The impact of this vulnerability is classified as MEDIUM severity with an attack vector over the network and a high availability impact.
Technical Details of CVE-2021-22553
This section provides detailed technical information about the vulnerability.
Vulnerability Description
The vulnerability arises from the issue of no session expiry in Jetty during git operations, leading to heap memory exhaustion.
Affected Systems and Versions
Gerrit versions less than 2.15.22, 2.16.26, 3.0.16, 3.1.12, 3.2.7, and 3.3.2 are affected by this vulnerability.
Exploitation Mechanism
Attackers can exploit this vulnerability by performing multiple git operations, causing a gradual exhaustion of heap memory on Gerrit servers.
Mitigation and Prevention
To prevent the exploitation of CVE-2021-22553 and enhance system security, consider the following measures.
Immediate Steps to Take
Upgrade Gerrit to any version equal to or above 2.15.22, 2.16.26, 3.0.16, 3.1.12, 3.2.7, or 3.3.2 to mitigate the risk of heap memory exhaustion.
Long-Term Security Practices
Implement regular security patches, conduct security audits, and monitor system resources to ensure the overall security of Gerrit servers.
Patching and Updates
Regularly update Gerrit to the latest versions available to address security vulnerabilities and enhance system performance.