Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-43797

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

Published

2021-12-09T19:15:07.960

Last Modified

2024-11-21T06:29:48.490

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-444
  • Type: Primary
    CWE-444
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application netty netty < 4.1.71 Yes
Application quarkus quarkus < 2.5.3 Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp snapcenter - Yes
Application oracle banking_deposits_and_lines_of_credit_servicing 2.7 Yes
Application oracle banking_party_management 2.7.0 Yes
Application oracle banking_platform 2.6.2 Yes
Application oracle coherence 12.2.1.4.0 Yes
Application oracle coherence 14.1.1.0.0 Yes
Application oracle communications_cloud_native_core_binding_support_function 1.11.0 Yes
Application oracle communications_cloud_native_core_network_slice_selection_function 1.8.0 Yes
Application oracle communications_cloud_native_core_policy 1.15.0 Yes
Application oracle communications_cloud_native_core_security_edge_protection_proxy 1.7.0 Yes
Application oracle communications_cloud_native_core_unified_data_repository 1.15.0 Yes
Application oracle communications_design_studio 7.4.2 Yes
Application oracle communications_instant_messaging_server 8.1 Yes
Application oracle helidon 1.4.10 Yes
Application oracle helidon 2.4.0 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Operating System debian debian_linux 10.0 Yes
Operating System debian debian_linux 11.0 Yes
References