Bug 1937364 (CVE-2021-21295) - CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing validation
Summary: CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing valida...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-21295
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1943713 1943714 1943715 1943716 1927083 1927084 1927085 1937365 1937366 1938226 1938252 1938318
Blocks: 1937367
TreeView+ depends on / blocked
 
Reported: 2021-03-10 13:34 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-07-05 16:24 UTC (History)
117 users (show)

Fixed In Version: netty-codec-http 4.1.60.Final
Doc Type: If docs needed, set a value
Doc Text:
In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling.
Clone Of:
Environment:
Last Closed: 2021-03-25 11:35:47 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:2689 0 None None None 2021-07-12 12:12:43 UTC
Red Hat Product Errata RHSA-2021:2755 0 None None None 2021-07-15 15:26:06 UTC
Red Hat Product Errata RHSA-2021:3225 0 None None None 2021-08-19 07:18:25 UTC
Red Hat Product Errata RHSA-2021:3656 0 None None None 2021-09-23 16:15:25 UTC
Red Hat Product Errata RHSA-2021:3658 0 None None None 2021-09-23 16:23:19 UTC
Red Hat Product Errata RHSA-2021:3660 0 None None None 2021-09-23 16:29:12 UTC
Red Hat Product Errata RHSA-2021:3700 0 None None None 2021-09-30 09:57:54 UTC
Red Hat Product Errata RHSA-2021:3880 0 None None None 2021-10-20 11:30:02 UTC
Red Hat Product Errata RHSA-2021:5134 0 None None None 2021-12-14 21:34:05 UTC
Red Hat Product Errata RHSA-2022:5498 0 None None None 2022-07-05 14:26:16 UTC

Description Guilherme de Almeida Suckevicz 2021-03-10 13:34:13 UTC
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

Reference:
https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj

Upstream patch:
https://github.com/netty/netty/commit/89c241e3b1795ff257af4ad6eadc616cb2fb3dc4

Comment 1 Guilherme de Almeida Suckevicz 2021-03-10 13:35:30 UTC
Created eclipse tracking bugs for this issue:

Affects: fedora-all [bug 1937366]


Created netty tracking bugs for this issue:

Affects: fedora-all [bug 1937365]

Comment 5 Ted Jongseok Won 2021-03-12 05:43:11 UTC
This vulnerability is out of security support scope for the following products:
 * Red Hat Enterprise Application Platform 6
 * Red Hat Enterprise Application Platform 5
 * Red Hat JBoss Operations Network 3
 * Red Hat Data Grid 7
 * Red Hat JBoss AMQ 6
 * Red Hat JBoss Fuse 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 7 Przemyslaw Roguski 2021-03-12 15:28:18 UTC
External References:

https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj

Comment 11 Anten Skrabec 2021-03-15 22:21:37 UTC
Statement:

Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.

Comment 12 Jonathan Christison 2021-03-22 12:57:53 UTC
Marking Red Hat AMQ Online as having a low impact, although vulnerable versions of netty are distributed and used none of the affected functionality is ever exposed publicly, one of the prerequisites of this flaw is that an attacker has the ability to alter http requests, as netty in AMQ Online does not handle user HTTP requests this prerequisite is not present, another prerequisite of this flaw is malicious http2 requests later go onto be proxied eg. load balanced, neither is true in AMQ Online.

Comment 14 errata-xmlrpc 2021-03-25 09:43:58 UTC
This issue has been addressed in the following products:

  Red Hat AMQ Online 1.7.0 GA

Via RHSA-2021:0986 https://access.redhat.com/errata/RHSA-2021:0986

Comment 15 Product Security DevOps Team 2021-03-25 11:35:47 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-21295

Comment 18 errata-xmlrpc 2021-03-31 09:38:14 UTC
This issue has been addressed in the following products:

  Red Hat build of Eclipse Vert.x 4.0.3

Via RHSA-2021:0943 https://access.redhat.com/errata/RHSA-2021:0943

Comment 19 errata-xmlrpc 2021-05-06 07:47:45 UTC
This issue has been addressed in the following products:

  AMQ Clients 2.y for RHEL 7
  AMQ Clients 2.y for RHEL 8

Via RHSA-2021:1511 https://access.redhat.com/errata/RHSA-2021:1511

Comment 20 errata-xmlrpc 2021-05-19 15:21:44 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2021:2051 https://access.redhat.com/errata/RHSA-2021:2051

Comment 21 errata-xmlrpc 2021-05-19 15:23:21 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2021:2047 https://access.redhat.com/errata/RHSA-2021:2047

Comment 22 errata-xmlrpc 2021-05-19 15:27:43 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2021:2046 https://access.redhat.com/errata/RHSA-2021:2046

Comment 23 errata-xmlrpc 2021-05-19 15:32:23 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2021:2048 https://access.redhat.com/errata/RHSA-2021:2048

Comment 24 errata-xmlrpc 2021-05-20 17:50:17 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.7

Via RHSA-2021:2070 https://access.redhat.com/errata/RHSA-2021:2070

Comment 25 errata-xmlrpc 2021-05-26 21:50:02 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid 8.2.0

Via RHSA-2021:2139 https://access.redhat.com/errata/RHSA-2021:2139

Comment 29 errata-xmlrpc 2021-07-12 12:12:31 UTC
This issue has been addressed in the following products:

  Red Hat AMQ 7.8.2

Via RHSA-2021:2689 https://access.redhat.com/errata/RHSA-2021:2689

Comment 31 errata-xmlrpc 2021-07-15 15:26:02 UTC
This issue has been addressed in the following products:

  Red Hat EAP-XP 2.0.0 via EAP 7.3.x base

Via RHSA-2021:2755 https://access.redhat.com/errata/RHSA-2021:2755

Comment 32 errata-xmlrpc 2021-08-19 07:18:20 UTC
This issue has been addressed in the following products:

  Red Hat AMQ Streams 1.8.0

Via RHSA-2021:3225 https://access.redhat.com/errata/RHSA-2021:3225

Comment 33 errata-xmlrpc 2021-09-23 16:15:19 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2021:3656 https://access.redhat.com/errata/RHSA-2021:3656

Comment 34 errata-xmlrpc 2021-09-23 16:23:13 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2021:3658 https://access.redhat.com/errata/RHSA-2021:3658

Comment 35 errata-xmlrpc 2021-09-23 16:29:06 UTC
This issue has been addressed in the following products:

  EAP 7.4.1 release

Via RHSA-2021:3660 https://access.redhat.com/errata/RHSA-2021:3660

Comment 36 errata-xmlrpc 2021-09-30 09:57:49 UTC
This issue has been addressed in the following products:

  Red Hat AMQ 7.9.0

Via RHSA-2021:3700 https://access.redhat.com/errata/RHSA-2021:3700

Comment 37 errata-xmlrpc 2021-10-20 11:29:56 UTC
This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.2.3

Via RHSA-2021:3880 https://access.redhat.com/errata/RHSA-2021:3880

Comment 38 errata-xmlrpc 2021-12-14 21:34:00 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.10

Via RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134

Comment 39 errata-xmlrpc 2022-07-05 14:26:12 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 6.11 for RHEL 7
  Red Hat Satellite 6.11 for RHEL 8

Via RHSA-2022:5498 https://access.redhat.com/errata/RHSA-2022:5498


Note You need to log in before you can comment on or make changes to this bug.