https://bugzilla.redhat.com/show_bug.cgi?id=2031958
Bug ID: 2031958
Summary: CVE-2021-43797 netty: control chars in header names
may lead to HTTP request smuggling
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
boliveir(a)redhat.com, brian.stansberry(a)redhat.com,
btotty(a)redhat.com, caswilli(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
clement.escoffier(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, ehelms(a)redhat.com,
eleandro(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ewolinet(a)redhat.com,
extras-orphan(a)fedoraproject.org, fjuma(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gsmet(a)redhat.com, hamadhan(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jerboaa(a)gmail.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jrokos(a)redhat.com, jross(a)redhat.com,
jschluet(a)redhat.com, jsherril(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kaycoth(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, loleary(a)redhat.com,
lpeer(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mburns(a)redhat.com, mhulan(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
myarboro(a)redhat.com, nmoumoul(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
orabin(a)redhat.com, pcreech(a)redhat.com,
pdelbell(a)redhat.com, pdrozd(a)redhat.com,
peholase(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
probinso(a)redhat.com, rchan(a)redhat.com,
rgodfrey(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
sbiarozk(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sd-operator-metering(a)redhat.com,
sdouglas(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com, sthorger(a)redhat.com,
swoodman(a)redhat.com, tbrisker(a)redhat.com,
tflannag(a)redhat.com, theute(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
vkumar(a)redhat.com, yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
Netty is an asynchronous event-driven network application framework for rapid
development of maintainable high performance protocol servers & clients. Netty
prior to version 4.1.7.1.Final skips control chars when they are present at the
beginning / end of the header name. It should instead fail fast as these are
not allowed by the spec and could lead to HTTP request smuggling. Failing to do
the validation might cause netty to "sanitize" header names before it forward
these to another remote system when used as proxy. This remote system can't see
the invalid usage anymore, and therefore does not do the validation itself.
Users should upgrade to version 4.1.7.1.Final to receive a patch.
Reference:
https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
Upstream patch:
https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e26438...
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2031958