PT-2021-7975 · Netty+5 · Netty+5

Published 2021-12-09 · Updated 2024-06-15 · CVE-2021-43797

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.71.Final

Description The issue is related to the incorrect handling of control characters in header names, which could lead to HTTP request smuggling. According to the specification, control characters at the beginning or end of the header name are not allowed. The software should fail fast when encountering such characters, but instead, it skips them. This can cause the software to "sanitize" header names before forwarding them to another remote system when used as a proxy, potentially allowing an attacker to impact the integrity of protected information.

Recommendations For Netty versions prior to 4.1.71.Final, users should upgrade to version 4.1.71.Final to resolve the issue. As a temporary workaround, consider disabling the use of control characters in header names until a patch is available. Restrict access to the proxy functionality to minimize the risk of exploitation. Avoid using the affected Netty version as a proxy until the issue is resolved.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-150

CWE-444

Related Identifiers

BDU:2023-08648

CVE-2021-43797

DLA-3268-1

DSA-5316-1

GHSA-WX5J-54MM-RQQQ

OESA-2021-1472

OESA-2022-1930

OPENSUSE-SU-2022_1271-1

OPENSUSE-SU-2022_2047-1

OPENSUSE-SU-2024:11743-1

OPENSUSE-SU-2024:11981-1

RHSA-2022:4918

RHSA-2022:4919

RHSA-2022:5498

RHSA-2022:6782

RHSA-2022:6783

RHSA-2022:7409

RHSA-2022:7410

RHSA-2022:7411

RLSA-2022:5498

SUSE-SU-2022:1271-1

SUSE-SU-2022:2047-1

SUSE-SU-2022_2047-1

USN-6049-1

Affected Products

Astra Linux

Linuxmint

Netty

Rocky Linux

Suse

Ubuntu

References · 530

• https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 · Patch
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://bdu.fstec.ru/vul/2023-08648 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-43797 · Security Note
• https://osv.dev/vulnerability/DSA-5316-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43797 · Security Note
• https://ubuntu.com/security/CVE-2021-37136 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://ubuntu.com/security/CVE-2021-43797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41915 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1472 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wx5j-54mm-rqqq · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11612 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:5498 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3268-1 · Vendor Advisory