CVE-2021-43797
published 2021-12-09CVE-2021-43797: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty…
PriorityP335medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
2.68%
84.1th percentile
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | netty | < netty 1:4.1.48-6 (bookworm) | netty 1:4.1.48-6 (bookworm) |
| netty | netty | < 4.1.71 | 4.1.71 |
| netty | netty | <= 4.1.7.0.Final | — |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u1 | 1:4.1.48-4+deb11u1 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-6 | 1:4.1.48-6 |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u1build0.22.04.1 | 1:4.1.48-4+deb11u1build0.22.04.1 |
| netty | netty | >= 0 < 1:4.0.34-1ubuntu0.1~esm1 | 1:4.0.34-1ubuntu0.1~esm1 |
| netty | netty | >= 0 < 1:4.1.7-4ubuntu0.1+esm2 | 1:4.1.7-4ubuntu0.1+esm2 |
| netty | netty | >= 0 < 1:4.1.45-1ubuntu0.1~esm1 | 1:4.1.45-1ubuntu0.1~esm1 |
| oracle | banking_deposits_and_lines_of_credit_servicing | — | — |
| oracle | banking_party_management | — | — |
| oracle | banking_platform | — | — |
| oracle | coherence | — | — |
| oracle | coherence | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | communications_cloud_native_core_network_slice_selection_function | — | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | — | — |
| oracle | communications_cloud_native_core_unified_data_repository | — | — |
| oracle | communications_design_studio | — | — |
| oracle | communications_instant_messaging_server | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian6.5MEDIUM
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2023-04-28·CVSS 7.5
CVE-2021-21295 [HIGH] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security (Netty) — CVE-2021-43797
vendor_oracle·2023-01-15·CVSS 6.5
CVE-2021-43797 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Security (Netty) — CVE-2021-43797
Oracle Oracle Communications Applications Risk Matrix: Security (Netty) vulnerability
CVE: CVE-2021-43797
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2023 (JAN 2023)
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Netty) — CVE-2021-43797
vendor_oracle·2022-07-15·CVSS 6.5
CVE-2021-43797 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Netty) — CVE-2021-43797
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Netty) vulnerability
CVE: CVE-2021-43797
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: ISC (Netty) — CVE-2021-43797
vendor_oracle·2022-04-15·CVSS 6.5
CVE-2021-43797 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: ISC (Netty) — CVE-2021-43797
Oracle Oracle Communications Applications Risk Matrix: ISC (Netty) vulnerability
CVE: CVE-2021-43797
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
netty: control chars in header names may lead to HTTP request smuggling
vendor_redhat·2021-12-09·CVSS 6.5
CVE-2021-43797 [MEDIUM] CWE-444 netty: control chars in header names may lead to HTTP request smuggling
netty: control chars in header names may lead to HTTP request smuggling
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
A flaw was found in Netty, specifically in the netty-
Debian
CVE-2021-43797: netty - Netty is an asynchronous event-driven network application framework for rapid de...
vendor_debian·2021·CVSS 6.5
CVE-2021-43797 [MEDIUM] CVE-2021-43797: netty - Netty is an asynchronous event-driven network application framework for rapid de...
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Scope: local
bookworm: resolved (fixed in 1:4.1.48-6)
bullseye: resolved (fixed in 1:4.1.48-4+deb11u1)
forky: resolved (fixed i
OSV
netty vulnerabilities
osv·2023-04-28·CVSS 7.5
CVE-2020-11612 [HIGH] netty vulnerabilities
netty vulnerabilities
It was discovered that Netty's Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2021-21295,
CVE-2021
OSV
CVE-2021-43797: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients
osv·2021-12-09·CVSS 6.5
CVE-2021-43797 [MEDIUM] CVE-2021-43797: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
GHSA
HTTP request smuggling in netty
ghsa·2021-12-09
CVE-2021-43797 [MEDIUM] CWE-444 HTTP request smuggling in netty
HTTP request smuggling in netty
### Impact
Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.
Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
OSV
HTTP request smuggling in netty
osv·2021-12-09
CVE-2021-43797 [MEDIUM] HTTP request smuggling in netty
HTTP request smuggling in netty
### Impact
Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.
Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
No detection rules found.
No public exploits indexed.
https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqqhttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20220107-0003/https://www.debian.org/security/2023/dsa-5316https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqqhttps://lists.debian.org/debian-lts-announce/2023/01/msg00008.htmlhttps://security.netapp.com/advisory/ntap-20220107-0003/https://www.debian.org/security/2023/dsa-5316https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2021-12-09
Published