CVE-2021-43797

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-43797
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 Patch Third Party Advisory
https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20220107-0003/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5316 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 Patch Third Party Advisory
https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20220107-0003/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5316 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

21 Nov 2024, 06:29

Type Values Removed Values Added
References () https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 - Patch, Third Party Advisory () https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 - Patch, Third Party Advisory
References () https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq - Third Party Advisory () https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html - Mailing List, Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20220107-0003/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20220107-0003/ - Third Party Advisory
References () https://www.debian.org/security/2023/dsa-5316 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5316 - Third Party Advisory
References () https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory
References () https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory () https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory

24 Feb 2023, 15:47

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2023/dsa-5316 - Third Party Advisory
  • (MLIST) https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html - Mailing List, Third Party Advisory
References (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Patch, Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*

25 Jul 2022, 18:17

Type Values Removed Values Added
References
  • (N/A) https://www.oracle.com/security-alerts/cpujul2022.html -

16 Jun 2022, 15:34

Type Values Removed Values Added
References (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory
CPE cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*

20 Apr 2022, 00:16

Type Values Removed Values Added
References
  • (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html -

19 Feb 2022, 03:15

Type Values Removed Values Added
Summary Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final to receive a patch. Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

08 Feb 2022, 16:40

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220107-0003/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220107-0003/ - Third Party Advisory
CPE cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*

21 Jan 2022, 19:15

Type Values Removed Values Added
Summary Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch. Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final to receive a patch.

10 Jan 2022, 14:10

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220107-0003/ -

14 Dec 2021, 20:19

Type Values Removed Values Added
CWE CWE-444
References (MISC) https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 - (MISC) https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 - Patch, Third Party Advisory
References (CONFIRM) https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq - (CONFIRM) https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq - Third Party Advisory
CVSS v2 : unknown
v3 : 6.5 		v2 : 4.3
v3 : 6.5
CPE cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

09 Dec 2021, 19:21

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-09 19:15

Updated : 2024-11-21 06:29

NVD link : CVE-2021-43797

Mitre link : CVE-2021-43797

CVE.ORG link : CVE-2021-43797

JSON object : View

Products Affected

oracle

  • communications_cloud_native_core_unified_data_repository
  • banking_deposits_and_lines_of_credit_servicing
  • communications_cloud_native_core_network_slice_selection_function
  • communications_cloud_native_core_policy
  • banking_platform
  • banking_party_management
  • communications_cloud_native_core_security_edge_protection_proxy
  • peoplesoft_enterprise_peopletools
  • communications_design_studio
  • helidon
  • communications_instant_messaging_server
  • coherence
  • communications_cloud_native_core_binding_support_function

quarkus

  • quarkus

netty

  • netty

netapp

  • oncommand_workflow_automation
  • snapcenter

debian

  • debian_linux
CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')