Bug 2031958 (CVE-2021-43797)
Summary: | CVE-2021-43797 netty: control chars in header names may lead to HTTP request smuggling | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | aboyko, aileenc, akoufoud, alazarot, anstephe, aos-bugs, asoldano, atangrin, ataylor, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bkearney, bmaxwell, bmontgom, boliveir, brian.stansberry, btotty, caswilli, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, dbecker, dkreling, dosoudil, drieden, ehelms, eleandro, eparis, etirelli, ewolinet, extras-orphan, fjuma, ggastald, ggaughan, gmalinko, gsmet, hamadhan, ibek, iweiss, janstey, java-sig-commits, jburrell, jcantril, jerboaa, jjoyce, jochrist, jpallich, jperkins, jrokos, jross, jschluet, jsherril, jstastny, jwon, kaycoth, krathod, kverlaen, kwills, lgao, lhh, loleary, lpeer, lthon, lzap, mburns, mhulan, mkolesni, mmccune, mnovotny, msochure, msvehla, mszynkie, myarboro, nmoumoul, nstielau, nwallace, orabin, pcreech, pdelbell, pdrozd, peholase, pgallagh, pjindal, pmackay, probinso, rchan, rgodfrey, rguimara, rrajasek, rruss, rstancel, rsvoboda, sbiarozk, sclewis, scohen, sd-operator-metering, sdouglas, slinaber, smaestri, spinder, sponnaga, sthorger, swoodman, theute, tom.jenkinson, tzimanyi, vkumar, yborgess |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | netty-codec-http 4.1.72.Final | Doc Type: | If docs needed, set a value |
Doc Text: |
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2022-02-14 13:47:44 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2031959, 2033638 | ||
Bug Blocks: | 2031960 |
Description
Guilherme de Almeida Suckevicz
2021-12-13 19:17:52 UTC
Created netty tracking bugs for this issue: Affects: fedora-all [bug 2031959] Marking the Red Hat AMQ Broker as having a low impact, although a vulnerable version of netty is distributed its use of netty is not as a proxy to any other http servers which is a prerequisite of the flaw. This issue has been addressed in the following products: Red Hat Data Grid 8.3.0 Via RHSA-2022:0520 https://access.redhat.com/errata/RHSA-2022:0520 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-43797 This issue has been addressed in the following products: Red Hat AMQ Streams 2.1.0 Via RHSA-2022:1345 https://access.redhat.com/errata/RHSA-2022:1345 This issue has been addressed in the following products: Red Hat OpenShift Logging 5.4 Via RHSA-2022:2216 https://access.redhat.com/errata/RHSA-2022:2216 This issue has been addressed in the following products: OpenShift Logging 5.2 Via RHSA-2022:2218 https://access.redhat.com/errata/RHSA-2022:2218 This issue has been addressed in the following products: OpenShift Logging 5.3 Via RHSA-2022:2217 https://access.redhat.com/errata/RHSA-2022:2217 This issue has been addressed in the following products: Red Hat build of Quarkus 2.7.5 Via RHSA-2022:4623 https://access.redhat.com/errata/RHSA-2022:4623 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919 This issue has been addressed in the following products: Red Hat AMQ 7.10.0 Via RHSA-2022:5101 https://access.redhat.com/errata/RHSA-2022:5101 This issue has been addressed in the following products: Red Hat Satellite 6.11 for RHEL 7 Red Hat Satellite 6.11 for RHEL 8 Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498 This issue has been addressed in the following products: Red Hat Fuse 7.11 Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532 This issue has been addressed in the following products: RHPAM 7.13.0 async Via RHSA-2022:5903 https://access.redhat.com/errata/RHSA-2022:5903 This issue has been addressed in the following products: Red Hat Single Sign-On 7.5 for RHEL 7 Via RHSA-2022:6782 https://access.redhat.com/errata/RHSA-2022:6782 This issue has been addressed in the following products: Red Hat Single Sign-On 7.5 for RHEL 8 Via RHSA-2022:6783 https://access.redhat.com/errata/RHSA-2022:6783 This issue has been addressed in the following products: Red Hat Single Sign-On Via RHSA-2022:6787 https://access.redhat.com/errata/RHSA-2022:6787 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 8 Via RHSA-2022:7410 https://access.redhat.com/errata/RHSA-2022:7410 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 7 Via RHSA-2022:7409 https://access.redhat.com/errata/RHSA-2022:7409 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 9 Via RHSA-2022:7411 https://access.redhat.com/errata/RHSA-2022:7411 This issue has been addressed in the following products: Red Hat Single Sign-On 7.6.1 Via RHSA-2022:7417 https://access.redhat.com/errata/RHSA-2022:7417 |