Bug 1927028 (CVE-2021-21290)

Summary:	CVE-2021-21290 netty: Information disclosure via the local system temporary directory
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aboyko, aileenc, akoufoud, alazarot, almorale, anstephe, aos-bugs, asoldano, atangrin, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bkearney, bmaxwell, bmontgom, brian.stansberry, btotty, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dkreling, dosoudil, dramseur, drieden, eleandro, eparis, etirelli, extras-orphan, ganandan, ggaughan, gmalinko, gsmet, hamadhan, hhudgeon, ibek, iweiss, janstey, java-sig-commits, jburrell, jcantril, jerboaa, jhunter, jochrist, jokerman, jpallich, jperkins, jross, jstastny, jwon, kaycoth, kmitts, krathod, kverlaen, kwills, lgao, loleary, lthon, lzap, mgala, mjudeiki, mmccune, mnovotny, msochure, msvehla, mszynkie, nmoumoul, nstielau, nwallace, pdrozd, pgallagh, pjindal, pmackay, probinso, rchan, rgodfrey, rguimara, rjerrido, rrajasek, rruss, rstancel, rsvoboda, rsynek, sbiarozk, sdaley, sd-operator-metering, sdouglas, smaestri, sochotni, sokeeffe, spinder, sponnaga, sthorger, swoodman, tflannag, theute, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	netty-codec-http 4.1.59.Final	Doc Type:	If docs needed, set a value
Doc Text:	In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-25 11:35:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1935021, 1935022, 1935023, 1935024, 1927029, 1927082, 1927083, 1927084, 1927085, 1927197, 1938226, 2027348
Bug Blocks:	1927030

Description Pedro Sampaio 2021-02-09 21:33:06 UTC

In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

References:

https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec
https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2

Comment 1 Pedro Sampaio 2021-02-09 21:34:01 UTC

Created netty tracking bugs for this issue:

Affects: fedora-all [bug 1927029]

Comment 4 Mark Cooper 2021-02-10 02:51:08 UTC

Upstream fix: https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec

Comment 12 Jonathan Christison 2021-02-16 13:33:54 UTC

This vulnerability is out of security support scope for the following products:

 * Red Hat JBoss Fuse 6
 * Red Hat JBoss A-MQ 6 
 * Red Hat JBoss Enterprise Application Platform 5
 * Red Hat JBoss Enterprise Application Platform 6
 * Red Hat JBoss Data Grid 6
 * Red Hat JBoss Data Grid 7

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 17 Ted Jongseok Won 2021-02-19 17:30:18 UTC

This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Operations Network 3

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 18 Jonathan Christison 2021-02-22 16:18:18 UTC

Marking Red Hat AMQ Broker 7, AMQ Online, AMQ Streams and AMQ Clients as all having a low impact, these products ship the affected netty artifacts but they do not use the vulnerable HttpPostRequestDecoder, HttpPostMultiPartRequestDecoder methods or the vulnerable AbstractDiskHttpData class

Comment 21 errata-xmlrpc 2021-03-25 09:43:56 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Online 1.7.0 GA

Via RHSA-2021:0986 https://access.redhat.com/errata/RHSA-2021:0986

Comment 22 Product Security DevOps Team 2021-03-25 11:35:27 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21290

Comment 23 errata-xmlrpc 2021-03-31 09:38:13 UTC

This issue has been addressed in the following products:

  Red Hat build of Eclipse Vert.x 4.0.3

Via RHSA-2021:0943 https://access.redhat.com/errata/RHSA-2021:0943

Comment 24 errata-xmlrpc 2021-05-06 07:47:49 UTC

This issue has been addressed in the following products:

  AMQ Clients 2.y for RHEL 7
  AMQ Clients 2.y for RHEL 8

Via RHSA-2021:1511 https://access.redhat.com/errata/RHSA-2021:1511

Comment 25 errata-xmlrpc 2021-05-19 15:21:45 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2021:2051 https://access.redhat.com/errata/RHSA-2021:2051

Comment 26 errata-xmlrpc 2021-05-19 15:23:19 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:2047 https://access.redhat.com/errata/RHSA-2021:2047

Comment 27 errata-xmlrpc 2021-05-19 15:27:44 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:2046 https://access.redhat.com/errata/RHSA-2021:2046

Comment 28 errata-xmlrpc 2021-05-19 15:32:20 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:2048 https://access.redhat.com/errata/RHSA-2021:2048

Comment 29 errata-xmlrpc 2021-05-20 17:50:14 UTC

This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.7

Via RHSA-2021:2070 https://access.redhat.com/errata/RHSA-2021:2070

Comment 30 errata-xmlrpc 2021-05-26 21:49:59 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 8.2.0

Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139

Comment 31 errata-xmlrpc 2021-06-02 14:23:47 UTC

This issue has been addressed in the following products:

  Red Hat EAP-XP via EAP 7.3.x base

Via RHSA-2021:2210 https://access.redhat.com/errata/RHSA-2021:2210

Comment 32 errata-xmlrpc 2021-07-12 12:12:20 UTC

This issue has been addressed in the following products:

  Red Hat AMQ 7.8.2

Via RHSA-2021:2689 https://access.redhat.com/errata/RHSA-2021:2689

Comment 34 errata-xmlrpc 2021-07-15 15:25:49 UTC

This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:2755 https://access.redhat.com/errata/RHSA-2021:2755

Comment 36 errata-xmlrpc 2021-08-19 07:18:19 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225

Comment 37 errata-xmlrpc 2021-09-30 09:57:39 UTC

This issue has been addressed in the following products:

  Red Hat AMQ 7.9.0

Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700

Comment 38 errata-xmlrpc 2021-10-20 11:29:48 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.2.3

Via RHSA-2021:3880 https://access.redhat.com/errata/RHSA-2021:3880

Comment 39 errata-xmlrpc 2021-12-14 21:33:36 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

Comment 40 errata-xmlrpc 2022-01-19 14:40:46 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.10 for RHEL 7

Via RHSA-2022:0190 https://access.redhat.com/errata/RHSA-2022:0190

Comment 41 errata-xmlrpc 2022-03-29 13:00:30 UTC

This issue has been addressed in the following products:

  RHPAM 7.12.1

Via RHSA-2022:1108 https://access.redhat.com/errata/RHSA-2022:1108

Comment 42 errata-xmlrpc 2022-03-29 13:16:34 UTC

This issue has been addressed in the following products:

  RHDM 7.12.1

Via RHSA-2022:1110 https://access.redhat.com/errata/RHSA-2022:1110

Comment 43 errata-xmlrpc 2022-07-05 14:26:12 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.11 for RHEL 7
  Red Hat Satellite 6.11 for RHEL 8

Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498