CVE-2021-21409

Aliases:GHSA-f256-j965-7f32
Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 30 Mar 2021, 15:05
Last modified:03 Aug 2024, 18:09

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v3.1 (cve.org)
EPSS Score
2.55% LOW
3% probability -0.61%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Mar 2021, 15:05
Published
Vulnerability first disclosed
03 Aug 2024, 18:09
Last Modified
Vulnerability information updated

Description

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 2.55%• Percentile: 86%

Techniques & Countermeasures

  • CWE-444•Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected Systems

  • debian•debian_linux

    10.0

  • io.netty•netty

    all

  • io.netty•netty-codec-http2

    ≥ 4.0.0, < 4.1.61.Final

  • org.jboss.netty•netty

    all

  • netapp•oncommand_api_services

    na

  • netapp•oncommand_workflow_automation

    na

  • netty•netty

    < 4.1.61 | < 4.1.61.Final

  • oracle•banking_corporate_lending_process_management

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•banking_credit_facilities_process_management

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•banking_trade_finance_process_management

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•coherence

    12.2.1.4.0 | 14.1.1.0.0

  • oracle•communications_brm_-_elastic_charging_engine

    12.0.0.3

  • oracle•communications_cloud_native_core_console

    1.7.0

  • oracle•communications_cloud_native_core_policy

    1.14.0

  • oracle•communications_design_studio

    7.4.2.0.0

  • oracle•communications_messaging_server

    8.1

  • oracle•helidon

    1.4.10 | 2.4.0

  • oracle•jd_edwards_enterpriseone_tools

    < 9.2.6.3

  • oracle•nosql_database

    < 21.1.12

  • oracle•primavera_gateway

    ≥ 17.12.0, ≤ 17.12.11 | ≥ 18.8.0, ≤ 18.8.11 | ≥ 19.12.0, ≤ 19.12.10

  • quarkus•quarkus

    ≤ 1.13.7

References (111)