CVE-2021-43797
Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
How to fix
- netty netty4.1.71 or later
- quarkus quarkus2.5.3 or later
- io.netty:netty-codec-http4.1.71.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.71 | 4.1.71 |
| quarkus quarkus | v < 2.5.3 | 2.5.3 |
| netapp oncommand_workflow_automation | No range specified | — |
| netapp snapcenter | No range specified | — |
| oracle banking_deposits_and_lines_of_credit_servicing | 2.7 | — |
| oracle banking_party_management | 2.7.0 | — |
| oracle banking_platform | 2.6.2 | — |
| oracle coherence | 12.2.1.4.0, 14.1.1.0.0 | — |
| oracle communications_cloud_native_core_binding_support_function | 1.11.0 | — |
| oracle communications_cloud_native_core_network_slice_selection_function | 1.8.0 | — |
| oracle communications_cloud_native_core_policy | 1.15.0 | — |
| oracle communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.15.0 | — |
| oracle communications_design_studio | 7.4.2 | — |
| oracle communications_instant_messaging_server | 8.1 | — |
| oracle helidon | 1.4.10, 2.4.0 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58, 8.59 | — |
| debian debian_linux | 10.0, 11.0 | — |
| io.netty:netty-codec-httpMaven | 4.0.0 ≤ v < 4.1.71.Final | 4.1.71.Final |
| org.jboss.netty:nettyMaven | No range specified | — |
| io.netty:nettyMaven | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.