CVE-2021-43797
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
MEDIUM 6.5
En bref
- Source
- NVD
- EPSS
- EPSS 2.88 % · centile 87 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Modified
Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Faiblesses (CWE)
- CWE-444 — Dissimulation de requête ou de réponse HTTP
Références
- https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
- https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220107-0003/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
- https://www.debian.org/security/2023/dsa-5316
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-wx5j-54mm-rqqq — HTTP request smuggling in netty
Références européennes
- ENISA EUVD · EUVD-2021-2607
- GCVE · GCVE-0-2021-43797
Avis du CERT-FR
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0661 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0608 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0106 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0021 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0031 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-0276 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-785 — Multiples vulnérabilités dans IBM Cognos Analytics · cert.ssi.gouv.fr
- CERTFR-2022-AVI-366 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*< 4.1.71cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*< 2.5.3cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| netty · netty | affected <= 4.1.7.0.Final |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |