Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch. Reference: https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq Upstream patch: https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
Created netty tracking bugs for this issue: Affects: fedora-all [bug 2031959]
Marking the Red Hat AMQ Broker as having a low impact, although a vulnerable version of netty is distributed its use of netty is not as a proxy to any other http servers which is a prerequisite of the flaw.
This issue has been addressed in the following products: Red Hat Data Grid 8.3.0 Via RHSA-2022:0520 https://access.redhat.com/errata/RHSA-2022:0520
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-43797
This issue has been addressed in the following products: Red Hat AMQ Streams 2.1.0 Via RHSA-2022:1345 https://access.redhat.com/errata/RHSA-2022:1345
This issue has been addressed in the following products: Red Hat OpenShift Logging 5.4 Via RHSA-2022:2216 https://access.redhat.com/errata/RHSA-2022:2216
This issue has been addressed in the following products: OpenShift Logging 5.2 Via RHSA-2022:2218 https://access.redhat.com/errata/RHSA-2022:2218
This issue has been addressed in the following products: OpenShift Logging 5.3 Via RHSA-2022:2217 https://access.redhat.com/errata/RHSA-2022:2217
This issue has been addressed in the following products: Red Hat build of Quarkus 2.7.5 Via RHSA-2022:4623 https://access.redhat.com/errata/RHSA-2022:4623
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919
This issue has been addressed in the following products: Red Hat AMQ 7.10.0 Via RHSA-2022:5101 https://access.redhat.com/errata/RHSA-2022:5101
This issue has been addressed in the following products: Red Hat Satellite 6.11 for RHEL 7 Red Hat Satellite 6.11 for RHEL 8 Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498
This issue has been addressed in the following products: Red Hat Fuse 7.11 Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532
This issue has been addressed in the following products: RHPAM 7.13.0 async Via RHSA-2022:5903 https://access.redhat.com/errata/RHSA-2022:5903
This issue has been addressed in the following products: Red Hat Single Sign-On 7.5 for RHEL 7 Via RHSA-2022:6782 https://access.redhat.com/errata/RHSA-2022:6782
This issue has been addressed in the following products: Red Hat Single Sign-On 7.5 for RHEL 8 Via RHSA-2022:6783 https://access.redhat.com/errata/RHSA-2022:6783
This issue has been addressed in the following products: Red Hat Single Sign-On Via RHSA-2022:6787 https://access.redhat.com/errata/RHSA-2022:6787
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 8 Via RHSA-2022:7410 https://access.redhat.com/errata/RHSA-2022:7410
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 7 Via RHSA-2022:7409 https://access.redhat.com/errata/RHSA-2022:7409
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6 for RHEL 9 Via RHSA-2022:7411 https://access.redhat.com/errata/RHSA-2022:7411
This issue has been addressed in the following products: Red Hat Single Sign-On 7.6.1 Via RHSA-2022:7417 https://access.redhat.com/errata/RHSA-2022:7417