2020-12-22 16:02:56 +00:00
{
"CVE_data_meta" : {
2021-03-30 09:04:27 -06:00
"ASSIGNER" : "security-advisories@github.com" ,
2020-12-22 16:02:56 +00:00
"ID" : "CVE-2021-21409" ,
2021-03-30 09:04:27 -06:00
"STATE" : "PUBLIC" ,
"TITLE" : "Possible request smuggling in HTTP/2 due missing validation of content-length"
2020-12-22 16:02:56 +00:00
} ,
2021-03-30 09:04:27 -06:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "netty" ,
"version" : {
"version_data" : [
{
"version_value" : "< 4.1.61.Final"
}
]
}
}
]
} ,
"vendor_name" : "netty"
}
]
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2020-12-22 16:02:56 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2021-03-30 09:04:27 -06:00
"value" : "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final."
}
]
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "HIGH" ,
"attackVector" : "NETWORK" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.9 ,
"baseSeverity" : "MEDIUM" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"
}
]
}
]
} ,
"references" : {
"reference_data" : [
{
"name" : "https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32" ,
"refsource" : "CONFIRM" ,
"url" : "https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32"
} ,
{
"name" : "https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj" ,
"refsource" : "MISC" ,
"url" : "https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj"
} ,
{
"name" : "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295" ,
"refsource" : "MISC" ,
"url" : "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295"
} ,
{
"name" : "https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432" ,
"refsource" : "MISC" ,
"url" : "https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432"
2021-04-06 12:00:46 +00:00
} ,
{
"refsource" : "DEBIAN" ,
"name" : "DSA-4885" ,
"url" : "https://www.debian.org/security/2021/dsa-4885"
2021-04-07 21:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-dev] 20210407 [jira] [Created] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r70c3a7bfa904f06a1902f4df20ee26e4f09a46b8fd3eb304dc57a2de@%3Cdev.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210407 [jira] [Assigned] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/ra66e93703e3f4bd31bdfd0b6fb0c32ae96b528259bb1aa2b6d38e401@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210407 [jira] [Created] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r2732aa3884cacfecac4c54cfaa77c279ba815cad44b464a567216f83@%3Cissues.zookeeper.apache.org%3E"
2021-04-08 10:00:39 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210408 [jira] [Comment Edited] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r0ca82fec33334e571fe5b388272260778883e307e15415d7b1443de2@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210408 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r823d4b27fcba8dad5fe945bdefce3ca5a0031187966eb6ef3cc22ba9@%3Cissues.zookeeper.apache.org%3E"
2021-04-08 13:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210408 [GitHub] [zookeeper] ayushmantri opened a new pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r101f82d8f3b5af0bf79aecbd5b2dd3b404f6bb51d1a54c2c3d29bed9@%3Cnotifications.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210408 [jira] [Updated] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/rf521ff2be2e2dd38984174d3451e6ee935c845948845c8fccd86371d@%3Cissues.zookeeper.apache.org%3E"
2021-04-08 14:00:44 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210408 [GitHub] [zookeeper] arshadmohammad commented on pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r5cbea8614812289a9b98d0cfc54b47f54cef424ac98d5e315b791795@%3Cnotifications.zookeeper.apache.org%3E"
2021-04-08 16:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-commits] 20210408 [zookeeper] branch master updated: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/rdd206d9dd7eb894cc089b37fe6edde2932de88d63a6d8368b44f5101@%3Ccommits.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210408 [jira] [Resolved] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/rac8cf45a1bab9ead5c9a860cbadd6faaeb7792203617b6ec3874736d@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-commits] 20210408 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r4a98827bb4a7edbd69ef862f2351391845697c40711820d10df52ca5@%3Ccommits.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-commits] 20210408 [zookeeper] branch branch-3.7 updated: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r69efd8ef003f612c43e4154e788ca3b1f837feaacd16d97854402355@%3Ccommits.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210408 [jira] [Assigned] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r4b8be87acf5b9c098a2ee350b5ca5716fe7afeaf0a21a4ee45a90687@%3Cissues.zookeeper.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-notifications] 20210408 [GitHub] [zookeeper] asfgit closed pull request #1678: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/re4b0141939370304d676fe23774d0c6fbc584b648919825402d0cb39@%3Cnotifications.zookeeper.apache.org%3E"
2021-04-08 19:00:39 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-commits] 20210408 [zookeeper] 01/02: ZOOKEEPER-4278: dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/rdd5715f3ee5e3216d5e0083a07994f67da6dbb9731ce9e7a6389b18e@%3Ccommits.zookeeper.apache.org%3E"
2021-04-09 07:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[zookeeper-issues] 20210409 [jira] [Commented] (ZOOKEEPER-4278) dependency-check:check failing - netty-transport-4.1.60.Final CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r1b3cb056364794f919aaf26ceaf7423de64e7fdd05a914066e7d5219@%3Cissues.zookeeper.apache.org%3E"
2021-04-19 14:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[pulsar-commits] 20210419 [GitHub] [pulsar] lhotari opened a new pull request #10266: [Security] Upgrade Netty to 4.1.63.Final to address CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/rf38e4dcdefc7c59f7ba0799a399d6d6e37b555d406a1dfc2fcbf0b35@%3Ccommits.pulsar.apache.org%3E"
2021-04-19 15:00:43 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[pulsar-commits] 20210419 [GitHub] [pulsar] lhotari commented on pull request #10266: [Security] Upgrade Netty to 4.1.63.Final to address CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r61564d86a75403b854cdafee67fc69c8b88c5f6802c2c838f4282cc8@%3Ccommits.pulsar.apache.org%3E"
2021-04-20 07:00:41 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[pulsar-commits] 20210420 [GitHub] [pulsar] eolivelli merged pull request #10266: [Security] Upgrade Netty to 4.1.63.Final to address CVE-2021-21409" ,
"url" : "https://lists.apache.org/thread.html/r7879ddcb990c835c6b246654770d836f9d031dee982be836744e50ed@%3Ccommits.pulsar.apache.org%3E"
2021-04-24 15:00:40 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[flink-issues] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx" ,
"url" : "https://lists.apache.org/thread.html/r5baac01f9e06c40ff7aab209d5751b3b58802c63734e33324b70a06a@%3Cissues.flink.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[flink-dev] 20210424 [jira] [Created] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx" ,
"url" : "https://lists.apache.org/thread.html/ra64d56a8a331ffd7bdcd24a9aaaeeedeacd5d639f5a683389123f898@%3Cdev.flink.apache.org%3E"
2021-04-26 10:00:50 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[flink-issues] 20210426 [jira] [Commented] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx" ,
"url" : "https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e@%3Cissues.flink.apache.org%3E"
} ,
{
"refsource" : "MLIST" ,
"name" : "[flink-issues] 20210426 [jira] [Updated] (FLINK-22441) In Flink v1.11.3 contains netty(version:3.10.6) netty(version:4.1.60) . There are many vulnerabilities, like CVE-2021-21409 etc. please confirm these version and fix. thx" ,
"url" : "https://lists.apache.org/thread.html/re7c69756a102bebce8b8681882844a53e2f23975a189363e68ad0324@%3Cissues.flink.apache.org%3E"
2020-12-22 16:02:56 +00:00
}
]
2021-03-30 09:04:27 -06:00
} ,
"source" : {
"advisory" : "GHSA-f256-j965-7f32" ,
"discovery" : "UNKNOWN"
2020-12-22 16:02:56 +00:00
}
}
