CVE-2021-21409
Possible request smuggling in HTTP/2 due missing validation of content-length
Severity Score
5.9
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
Netty es un framework de aplicación de red de código abierto y asíncrono event-driven para el desarrollo rápido de servidores y clientes de protocolo de alto rendimiento mantenibles. En Netty (io.netty:netty-codec-http2) versiones anteriores a 4.1.61.Final se presenta una vulnerabilidad que permite el trafico no autorizado de peticiones. El encabezado content-length no es comprobado correctamente si la petición solo usa un único Http2HeaderFrame con endStream establecido en verdadero. Esto podría conllevar al trafico no autorizado de peticiones si la petición se envía a un peer remoto y se traduce a HTTP/1.1. Este es un seguimiento de GHSA-wm47-8v5p-wjpj/CVE-2021-21295 que no pudo solucionar este caso. Esto se corrigió como parte de la versión 4.1.61.Final.
A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The highest threat from this vulnerability is to integrity.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-12-22 CVE Reserved
- 2021-03-30 CVE Published
- 2024-05-31 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CAPEC
References (61)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2021/dsa-4885 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2021-21409 | 2022-07-05 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1944888 | 2022-07-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Netty Search vendor "Netty" | Netty Search vendor "Netty" for product "Netty" | < 4.1.61 Search vendor "Netty" for product "Netty" and version " < 4.1.61" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Api Services Search vendor "Netapp" for product "Oncommand Api Services" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation" | - | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Corporate Lending Process Management Search vendor "Oracle" for product "Banking Corporate Lending Process Management" | 14.2.0 Search vendor "Oracle" for product "Banking Corporate Lending Process Management" and version "14.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Corporate Lending Process Management Search vendor "Oracle" for product "Banking Corporate Lending Process Management" | 14.3.0 Search vendor "Oracle" for product "Banking Corporate Lending Process Management" and version "14.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Corporate Lending Process Management Search vendor "Oracle" for product "Banking Corporate Lending Process Management" | 14.5.0 Search vendor "Oracle" for product "Banking Corporate Lending Process Management" and version "14.5.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Credit Facilities Process Management Search vendor "Oracle" for product "Banking Credit Facilities Process Management" | 14.2.0 Search vendor "Oracle" for product "Banking Credit Facilities Process Management" and version "14.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Credit Facilities Process Management Search vendor "Oracle" for product "Banking Credit Facilities Process Management" | 14.3.0 Search vendor "Oracle" for product "Banking Credit Facilities Process Management" and version "14.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Credit Facilities Process Management Search vendor "Oracle" for product "Banking Credit Facilities Process Management" | 14.5.0 Search vendor "Oracle" for product "Banking Credit Facilities Process Management" and version "14.5.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Trade Finance Process Management Search vendor "Oracle" for product "Banking Trade Finance Process Management" | 14.2.0 Search vendor "Oracle" for product "Banking Trade Finance Process Management" and version "14.2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Trade Finance Process Management Search vendor "Oracle" for product "Banking Trade Finance Process Management" | 14.3.0 Search vendor "Oracle" for product "Banking Trade Finance Process Management" and version "14.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Banking Trade Finance Process Management Search vendor "Oracle" for product "Banking Trade Finance Process Management" | 14.5.0 Search vendor "Oracle" for product "Banking Trade Finance Process Management" and version "14.5.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Coherence Search vendor "Oracle" for product "Coherence" | 12.2.1.4.0 Search vendor "Oracle" for product "Coherence" and version "12.2.1.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Coherence Search vendor "Oracle" for product "Coherence" | 14.1.1.0.0 Search vendor "Oracle" for product "Coherence" and version "14.1.1.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Brm - Elastic Charging Engine Search vendor "Oracle" for product "Communications Brm - Elastic Charging Engine" | 12.0.0.3 Search vendor "Oracle" for product "Communications Brm - Elastic Charging Engine" and version "12.0.0.3" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Cloud Native Core Console Search vendor "Oracle" for product "Communications Cloud Native Core Console" | 1.7.0 Search vendor "Oracle" for product "Communications Cloud Native Core Console" and version "1.7.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Cloud Native Core Policy Search vendor "Oracle" for product "Communications Cloud Native Core Policy" | 1.14.0 Search vendor "Oracle" for product "Communications Cloud Native Core Policy" and version "1.14.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Design Studio Search vendor "Oracle" for product "Communications Design Studio" | 7.4.2.0.0 Search vendor "Oracle" for product "Communications Design Studio" and version "7.4.2.0.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Messaging Server Search vendor "Oracle" for product "Communications Messaging Server" | 8.1 Search vendor "Oracle" for product "Communications Messaging Server" and version "8.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Helidon Search vendor "Oracle" for product "Helidon" | 1.4.10 Search vendor "Oracle" for product "Helidon" and version "1.4.10" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Helidon Search vendor "Oracle" for product "Helidon" | 2.4.0 Search vendor "Oracle" for product "Helidon" and version "2.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Jd Edwards Enterpriseone Tools Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" | < 9.2.6.3 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version " < 9.2.6.3" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Nosql Database Search vendor "Oracle" for product "Nosql Database" | < 21.1.12 Search vendor "Oracle" for product "Nosql Database" and version " < 21.1.12" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Primavera Gateway Search vendor "Oracle" for product "Primavera Gateway" | >= 17.12.0 <= 17.12.11 Search vendor "Oracle" for product "Primavera Gateway" and version " >= 17.12.0 <= 17.12.11" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Primavera Gateway Search vendor "Oracle" for product "Primavera Gateway" | >= 18.8.0 <= 18.8.11 Search vendor "Oracle" for product "Primavera Gateway" and version " >= 18.8.0 <= 18.8.11" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Primavera Gateway Search vendor "Oracle" for product "Primavera Gateway" | >= 19.12.0 <= 19.12.10 Search vendor "Oracle" for product "Primavera Gateway" and version " >= 19.12.0 <= 19.12.10" | - |
Affected
| ||||||
| Quarkus Search vendor "Quarkus" | Quarkus Search vendor "Quarkus" for product "Quarkus" | <= 1.13.7 Search vendor "Quarkus" for product "Quarkus" and version " <= 1.13.7" | - |
Affected
| ||||||