ID

VAR-202103-1554

CVE

CVE-2021-21409

TITLE

Netty Environmental problem loophole

DESCRIPTION

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Installation instructions are available from the Fuse 7.10.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/ 4. Bugs fixed (https://bugzilla.redhat.com/): 1739497 - CVE-2019-10744 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties 1802531 - CVE-2019-12415 poi: a specially crafted Microsoft Excel document allows attacker to read files from the local filesystem 1831139 - CVE-2020-9488 log4j: improper validation of certificate with host mismatch in SMTP appender 1851014 - CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete 1851019 - CVE-2020-2875 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete 1887648 - CVE-2020-13943 tomcat: Apache Tomcat HTTP/2 Request mix-up 1898907 - CVE-2020-26217 XStream: remote code execution due to insecure XML deserialization when relying on blocklists 1901304 - CVE-2020-27782 undertow: special character in query results in server errors 1902826 - CVE-2020-27218 jetty: buffer not correctly recycled in Gzip Request inflation 1904221 - CVE-2020-17527 tomcat: HTTP/2 request header mix-up 1905796 - CVE-2020-35510 jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client 1908837 - CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling 1922102 - CVE-2021-23926 xmlbeans: allowed malicious XML input may lead to XML Entity Expansion attack 1922123 - CVE-2020-17521 groovy: OS temporary directory leads to information disclosure 1923405 - CVE-2021-20218 fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise 1927028 - CVE-2021-21290 netty: Information disclosure via the local system temporary directory 1928172 - CVE-2020-13949 libthrift: potential DoS when processing untrusted payloads 1930423 - CVE-2020-28491 jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception 1933808 - CVE-2020-11987 batik: SSRF due to improper input validation by the NodePickerPanel 1933816 - CVE-2020-11988 xmlgraphics-commons: SSRF due to improper input validation by the XMPParser 1934116 - CVE-2020-27223 jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS 1937364 - CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing validation 1939839 - CVE-2021-27568 json-smart: uncaught exception may lead to crash or information disclosure 1942539 - CVE-2021-21341 XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream 1942545 - CVE-2021-21342 XStream: SSRF via crafted input stream 1942550 - CVE-2021-21343 XStream: arbitrary file deletion on the local host via crafted input stream 1942554 - CVE-2021-21344 XStream: Unsafe deserizaliation of javax.sql.rowset.BaseRowSet 1942558 - CVE-2021-21345 XStream: Unsafe deserizaliation of com.sun.corba.se.impl.activation.ServerTableEntry 1942578 - CVE-2021-21346 XStream: Unsafe deserizaliation of sun.swing.SwingLazyValue 1942629 - CVE-2021-21347 XStream: Unsafe deserizaliation of com.sun.tools.javac.processing.JavacProcessingEnvironment NameProcessIterator 1942633 - CVE-2021-21348 XStream: ReDoS vulnerability 1942635 - CVE-2021-21349 XStream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host 1942637 - CVE-2021-21350 XStream: Unsafe deserizaliation of com.sun.org.apache.bcel.internal.util.ClassLoader 1942642 - CVE-2021-21351 XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 1945710 - CVE-2021-28163 jetty: Symlink directory exposes webapp directory contents 1945712 - CVE-2021-28164 jetty: Ambiguous paths can access WEB-INF 1946341 - CVE-2021-22696 cxf: OAuth 2 authorization service vulnerable to DDos attacks 1948001 - CVE-2021-3536 wildfly: XSS via admin console when creating roles in domain mode 1948752 - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 1962879 - CVE-2020-15522 bouncycastle: Timing issue within the EC math library 1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate 1970930 - CVE-2021-3597 undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS 1971016 - CVE-2021-28169 jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory 1973392 - CVE-2021-30468 CXF: Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter 1974854 - CVE-2021-22118 spring-web: (re)creating the temporary storage directory could result in a privilege escalation within WebFlux application 1974891 - CVE-2021-34428 jetty: SessionListener can prevent a session from being invalidated breaking logout 1977362 - CVE-2021-3629 undertow: potential security issue in flow control over HTTP/2 may lead to DOS 1981527 - CVE-2021-30129 mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server 1991299 - CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS 1995259 - CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 5. Bugs fixed (https://bugzilla.redhat.com/): 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 2004133 - CVE-2021-37136 netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data 2004135 - CVE-2021-37137 netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way 2030932 - CVE-2021-44228 log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1775 - [release-5.2] Syslog output is serializing json incorrectly LOG-1824 - [release-5.2] Rejected by Elasticsearch and unexpected json-parsing LOG-1963 - [release-5.2] CLO panic: runtime error: slice bounds out of range [:-1] LOG-1970 - Applying cluster state is causing elasticsearch to hit an issue and become unusable 6. Description: AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. Bugs fixed (https://bugzilla.redhat.com/): 1927028 - CVE-2021-21290 netty: Information disclosure via the local system temporary directory 1934116 - CVE-2020-27223 jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS 1936629 - CVE-2021-3425 Red Hat AMQ Broker: discloses JDBC username and password in the application log file 1937364 - CVE-2021-21295 netty: possible request smuggling in HTTP/2 due missing validation 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 1945710 - CVE-2021-28163 jetty: Symlink directory exposes webapp directory contents 1945712 - CVE-2021-28164 jetty: Ambiguous paths can access WEB-INF 1945714 - CVE-2021-28165 jetty: Resource exhaustion when receiving an invalid large TLS frame 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 6 security update Advisory ID: RHSA-2021:2692-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:2692 Issue date: 2021-07-13 CVE Names: CVE-2021-3536 CVE-2021-21409 ===================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 7.3 for RHEL 6 Server - noarch 3. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.8 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.3.7, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.8 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * netty: Request smuggling via content-length header (CVE-2021-21409) * wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1944888 - CVE-2021-21409 netty: Request smuggling via content-length header 1948001 - CVE-2021-3536 wildfly: XSS via admin console when creating roles in domain mode 6. JIRA issues fixed (https://issues.jboss.org/): JBEAP-20264 - [GSS](7.3.z) ISPN-12787 - Non Transactional Cache needs to be invalidated after commit on JPQL update/delete operation JBEAP-20503 - [GSS](7.3.z) WFCORE-5185 - Update ProviderDefinition to use optimised service loading API JBEAP-20623 - [GSS](7.3.z) Upgrade Hibernate ORM from 5.3.20.Final-redhat-00001 to 5.3.20.SP1-redhat-00001 JBEAP-21178 - Tracker bug for the EAP 7.3.8 release for RHEL-6 JBEAP-21406 - [GSS](7.3.z) Upgrade Ironjacamar from 1.4.30.Final-redhat-00001 to 1.4.33.Final-redhat-00001 JBEAP-21421 - (7.3.z) Upgrade Infinispan from 9.4.22.Final-redhat-00001 to 9.4.23.Final-redhat-00001 JBEAP-21434 - (7.3.z) Upgrade wildfly-http-client from 1.0.26.Final-redhat-00001 to 1.0.28.Final-redhat-00001 JBEAP-21435 - (7.3.z) Upgrade Elytron from 1.10.12.Final-redhat-00001 to 1.10.13.Final-redhat-00001 JBEAP-21437 - (7.3.z) Upgrade netty from 4.1.60.Final to 4.1.63 JBEAP-21441 - (7.3.z) Upgrade Undertow from 2.0.35.SP1-redhat-00001 to 2.0.38.SP1-redhat-00001 JBEAP-21443 - (7.3.z) Upgrade jberet from 1.3.7.Final-redhat-00001 to 1.3.8.Final-redhat-00001 JBEAP-21444 - (7.3.z) Upgrade wf-core from 10.1.20.Final-redhat-00001 to 10.1.21.Final-redhat-00001 JBEAP-21567 - [GSS](7.3.z) Upgrade HAL from 3.2.14.Final-redhat-00001 to 3.2.15.Final-redhat-00001 JBEAP-21582 - (7.3.z) Upgrade remoting from 5.0.20.SP1-redhat-00001 to 5.0.23.Final-redhat-00001 JBEAP-21739 - (7.3.z) Upgrade elytron-web from 1.6.2.Final-redhat-00001 to 1.6.3.Final-redhat-00001 JBEAP-21977 - [SET](7.3.z) Update product CP branch github template 7. Package List: Red Hat JBoss EAP 7.3 for RHEL 6 Server: Source: eap7-elytron-web-1.6.3-1.Final_redhat_00001.1.el6eap.src.rpm eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el6eap.src.rpm eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el6eap.src.rpm eap7-infinispan-9.4.23-1.Final_redhat_00001.1.el6eap.src.rpm eap7-ironjacamar-1.4.33-1.Final_redhat_00001.1.el6eap.src.rpm eap7-jberet-1.3.8-1.Final_redhat_00001.1.el6eap.src.rpm eap7-jboss-remoting-5.0.23-1.Final_redhat_00001.1.el6eap.src.rpm eap7-jboss-server-migration-1.7.2-7.Final_redhat_00008.1.el6eap.src.rpm eap7-netty-4.1.63-1.Final_redhat_00001.1.el6eap.src.rpm eap7-undertow-2.0.38-1.SP1_redhat_00001.1.el6eap.src.rpm eap7-wildfly-7.3.8-1.GA_redhat_00001.1.el6eap.src.rpm eap7-wildfly-elytron-1.10.13-1.Final_redhat_00001.1.el6eap.src.rpm eap7-wildfly-http-client-1.0.28-1.Final_redhat_00001.1.el6eap.src.rpm noarch: eap7-hal-console-3.2.15-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-hibernate-5.3.20-3.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-hibernate-core-5.3.20-3.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-hibernate-entitymanager-5.3.20-3.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-hibernate-envers-5.3.20-3.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-hibernate-java8-5.3.20-3.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-cachestore-jdbc-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-cachestore-remote-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-client-hotrod-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-commons-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-core-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-hibernate-cache-commons-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-hibernate-cache-spi-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-infinispan-hibernate-cache-v53-9.4.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-common-api-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-common-impl-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-common-spi-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-core-api-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-core-impl-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-deployers-common-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-jdbc-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-ironjacamar-validator-1.4.33-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-jberet-1.3.8-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-jberet-core-1.3.8-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-jboss-remoting-5.0.23-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-jboss-server-migration-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-cli-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-core-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap6.4-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap6.4-to-eap7.3-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.0-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.1-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.2-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.2-to-eap7.3-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-eap7.3-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly10.0-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly10.1-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly11.0-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly12.0-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly13.0-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly14.0-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly15.0-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly16.0-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly17.0-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly18.0-server-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly8.2-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-jboss-server-migration-wildfly9.0-1.7.2-7.Final_redhat_00008.1.el6eap.noarch.rpm eap7-netty-4.1.63-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-netty-all-4.1.63-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-undertow-2.0.38-1.SP1_redhat_00001.1.el6eap.noarch.rpm eap7-undertow-server-1.6.3-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-7.3.8-1.GA_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-elytron-1.10.13-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-elytron-tool-1.10.13-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-client-common-1.0.28-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-ejb-client-1.0.28-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-naming-client-1.0.28-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-http-transaction-client-1.0.28-1.Final_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-javadocs-7.3.8-1.GA_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-modules-7.3.8-1.GA_redhat_00001.1.el6eap.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYO2QgNzjgjWX9erEAQgphBAAp7ZyTc68wBYysk4oE3fO4lT0ne2ubruh l4yAz6VgLS7xbckXxmtU27urR9HE6vijKZYz4qoUzB1IzacWDhaR6hvuuhpk7Hu6 GLJ0+YPOSxjWTJgx+YD5mTOxQCmRKtxg4oUzO1fA1KZYqeuAMfNPzBfrVReDE7Oi +eGiRINZawWjns/5KkdtulV+/77VhhGBf0CsOlK23mqX86C9BW4OBuFqBOTbWByL +pw4jSjpRDdxxT+tl8ffmkBxHDSc/MSw5HwpyDEfkeXJ/I0wYglCW7pDU6kgOVni DUIvXaF24KP51et14QNACUHmXTT6kYZ8knXqV7f99zYeCPRp3OVgp+f06uisSEP1 WJY28KHnqv5fB//GWoJII3nA4GwbZDXtFClxkgl4ENW1b6irsSXW15VAARm/IWS2 7nAZlg0PYtA1ONZ5zYyzUMlOZnRP7HNSORpOAn/N/N9xk4Pc3nxsx99B1UZs4Rad zY5yhLHoFg8GGWOjmDpO2/UTy5CM8EwhlxFuH+mW7HrxZpwQ3ReNC6/+Q+N5t3QT XQNG4ZLs3Y4k8ElUZTPU5gXo79Xy+gHRlyvj59V8qMV5Lyw/hLv30ZVbhHkNdu1J L6GY47/wRLpwt2AG322w9KmHUjPTsseF68SO2tmZUsC6xfdBcqK0P1TB7jEBwuiZ sXUR7+Da0Mg= =Xv5P -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . The References section of this erratum contains a download link for the update. You must be logged in to download the update. ========================================================================== Ubuntu Security Notice USN-6049-1 April 28, 2023 netty vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 ESM - Ubuntu 18.04 ESM - Ubuntu 16.04 ESM Summary: Several security issues were fixed in Netty. Software Description: - netty: Java NIO client/server socket framework Details: It was discovered that Netty's Zlib decoders did not limit memory allocations. A remote attacker could possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a denial of service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-11612) It was discovered that Netty created temporary files with excessive permissions. A local attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290) It was discovered that Netty did not properly validate content-length headers. A remote attacker could possibly use this issue to smuggle requests. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2021-21295, CVE-2021-21409) It was discovered that Netty's Bzip2 decompression decoder did not limit the decompressed output data size. A remote attacker could possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a denial of service. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-37136) It was discovered that Netty's Snappy frame decoder function did not limit chunk lengths. A remote attacker could possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a denial of service. (CVE-2021-37137) It was discovered that Netty did not properly handle control chars at the beginning and end of header names. A remote attacker could possibly use this issue to smuggle requests. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-43797) It was discovered that Netty could be made into an infinite recursion when parsing a malformed crafted message. A remote attacker could possibly use this issue to cause Netty to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41881) It was discovered that Netty did not validate header values under certain circumstances. A remote attacker could possibly use this issue to perform HTTP response splitting via malicious header values. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41915) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.10: libnetty-java 1:4.1.48-5ubuntu0.1 Ubuntu 22.04 LTS: libnetty-java 1:4.1.48-4+deb11u1build0.22.04.1 Ubuntu 20.04 ESM: libnetty-java 1:4.1.45-1ubuntu0.1~esm1 Ubuntu 18.04 ESM: libnetty-java 1:4.1.7-4ubuntu0.1+esm2 Ubuntu 16.04 ESM: libnetty-java 1:4.0.34-1ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6049-1 CVE-2020-11612, CVE-2021-21290, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2021-37137, CVE-2021-43797, CVE-2022-41881, CVE-2022-41915 Package Information: https://launchpad.net/ubuntu/+source/netty/1:4.1.48-5ubuntu0.1 https://launchpad.net/ubuntu/+source/netty/1:4.1.48-4+deb11u1build0.22.04.1

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

environmental issue

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-02-10T21:26:55.696000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE