CVE-2021-21409
Description
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
How to fix
- netty netty4.1.61 or later
- oracle jd_edwards_enterpriseone_tools9.2.6.3 or later
- oracle nosql_database21.1.12 or later
- io.netty:netty-codec-http24.1.61.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.61 | 4.1.61 |
| debian debian_linux | 10.0 | — |
| netapp oncommand_api_services | No range specified | — |
| netapp oncommand_workflow_automation | No range specified | — |
| oracle banking_corporate_lending_process_management | 14.2.0, 14.3.0, 14.5.0 | — |
| oracle banking_credit_facilities_process_management | 14.2.0, 14.3.0, 14.5.0 | — |
| oracle banking_trade_finance_process_management | 14.2.0, 14.3.0, 14.5.0 | — |
| oracle coherence | 12.2.1.4.0, 14.1.1.0.0 | — |
| oracle communications_brm_-_elastic_charging_engine | 12.0.0.3 | — |
| oracle communications_cloud_native_core_console | 1.7.0 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle communications_design_studio | 7.4.2.0.0 | — |
| oracle communications_messaging_server | 8.1 | — |
| oracle helidon | 1.4.10, 2.4.0 | — |
| oracle jd_edwards_enterpriseone_tools | v < 9.2.6.3 | 9.2.6.3 |
| oracle nosql_database | v < 21.1.12 | 21.1.12 |
| oracle primavera_gateway | 17.12.0 ≤ v ≤ 17.12.11, 18.8.0 ≤ v ≤ 18.8.11, 19.12.0 ≤ v ≤ 19.12.10 | — |
| quarkus quarkus | v ≤ 1.13.7 | — |
| io.netty:netty-codec-http2Maven | 4.0.0 ≤ v < 4.1.61.Final | 4.1.61.Final |
| org.jboss.netty:nettyMaven | No range specified | — |
| io.netty:nettyMaven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.