CVEvulnerability
CVE-2021-43797
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-12-09
- Last modified
- 2026-10-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-444
Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Affected configurations
• netty netty (< 4.1.71)
• quarkus quarkus (< 2.5.3)
• netapp oncommand workflow automation
• netapp snapcenter
• oracle banking deposits and lines of credit servicing 2.7
• oracle banking party management 2.7.0
• oracle banking platform 2.6.2
• oracle coherence 12.2.1.4.0
• oracle coherence 14.1.1.0.0
• oracle communications cloud native core binding support function 1.11.0
• oracle communications cloud native core network slice selection function 1.8.0
• oracle communications cloud native core policy 1.15.0
• oracle communications cloud native core security edge protection proxy 1.7.0
• oracle communications cloud native core unified data repository 1.15.0
• oracle communications design studio 7.4.2
• oracle communications instant messaging server 8.1
• oracle helidon 1.4.10
• oracle helidon 2.4.0
• oracle peoplesoft enterprise peopletools 8.58
• oracle peoplesoft enterprise peopletools 8.59
• debian debian linux 10.0
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-444 Inconsistent Interpretation of HTTP Requests weakness
References
- https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 Patch, Third Party Advisory
- https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220107-0003/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5316 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323 Patch, Third Party Advisory
- https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220107-0003/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5316 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory