Skip to content
Sign in
6.5 Medium

CVE-2021-22553 Any git operation is passed through Jetty and a session is created

Description

Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above.

Affected products and versions

Product Affected versions Fixed in
Gerrit 3.3 earliest → < 3.3.2 3.3.2
Gerrit 3.2 earliest → < 3.2.7 3.2.7
Gerrit 3.1 earliest → < 3.1.12 3.1.12
Gerrit 3.0 earliest → < 3.0.16 3.0.16
Gerrit 2.16 earliest → < 2.16.26 2.16.26
Gerrit 2.15 earliest → < 2.15.22 2.15.22
Track this CVE