Inconsistent interpretation of HTTP requests in Netty - CVE-2021-43797

Vulnerability identifier: #VU61810

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-43797

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests when processing control chars present at the beginning / end of the header name. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Netty
IBM Observability with Instana
Log Analysis
Netcool Operations Insight
Helidon
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Communications Cloud Native Core Binding Support Function
IBM Cloud Transformation Advisor
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Party Management
IBM Watson Knowledge Catalog in Cloud Pak for Data
OpenShift Logging
Oracle Communications Design Studio
Autodesk Infraworks
IBM Operations Analytics Predictive Insights
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Protect Plus
IBM Cloud Pak for Watson AIOps
Oracle Utilities Network Management System
IBM Watson Machine Learning Accelerator
Oracle Banking Platform
Security QRadar EDR
DataStage on Cloud Pak for Data
CloudLink
IBM Sterling Order Management
Debian Linux
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Ubuntu
openEuler
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository
AMQ Broker
JBoss Enterprise Application Platform
Oracle Coherence
AMQ Streams
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Single Sign-On
Oracle Communications Instant Messaging Server
PeopleSoft Enterprise PeopleTools
Oracle Communications BRM - Elastic Charging Engine
rh-sso7-keycloak (Red Hat package)
libnetty-java (Ubuntu package)
rh-sso7 (Red Hat package)
netty3
netty3-javadoc
netty-help
netty
netty (Debian package)
rh-sso7-javapackages-tools (Red Hat package)
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
JBoss Data Grid

Install updates from vendor's website.

Netty - update to 4.1.71
Log Analysis - update to 1.3.8
Netcool Operations Insight - update to 1.6.5
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.7
IBM Cloud Transformation Advisor - update to 3.2.1
Security QRadar EDR - update to 3.12.15
DataStage on Cloud Pak for Data - update to 4.8.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
OpenShift Logging - addressed in versions 5.2.10, 5.3.7, 5.4.1
AMQ Broker - update to 7.10.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.0
JBoss Enterprise Application Platform - update to 7.4.5
Red Hat Single Sign-On - addressed in versions 7.5.3, 7.6.1
rh-sso7-keycloak (Red Hat package) - addressed in versions 15.0.8-1.redhat_00001.1.el7sso, 15.0.8-1.redhat_00001.1.el8sso, 18.0.3-1.redhat_00001.1.el7sso, 18.0.3-1.redhat_00001.1.el8sso
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
libnetty-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1:4.1.48-4+deb11u1build0.22.04.1, 1:4.1.48-5ubuntu0.1
IBM Operations Analytics Predictive Insights - update to 1.3.6.6
rh-sso7 (Red Hat package) - update to 1-5.el9sso
Cloud Pak for Security (CP4S) - update to 1.10.12.0
AMQ Streams - update to 2.1.0
netty3 - update to 3.10.6-150200.3.3.2
netty3-javadoc - update to 3.10.6-150200.3.3.2
netty-help - addressed in versions 4.1.13-14, 4.1.13-17
netty - addressed in versions 4.1.13-14, 4.1.13-17
netty (Debian package) - update to 1:4.1.48-4+deb11u1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
rh-sso7-javapackages-tools (Red Hat package) - update to 6.0.0-7.el9sso
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
CloudLink - update to 8.0-3.10.5.1
JBoss Data Grid - update to 8.3.0
IBM Sterling Order Management - update to 10.0.0.29
IBM Spectrum Protect Plus - update to 10.1.6.4

• https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq
• https://github.com/netty/netty/commit/07aa6b5938a8b6ed7a6586e066400e2643897323
• https://security.netapp.com/advisory/ntap-20220107-0003/

• HTTP request smuggling in Netty
• IBM Watson Assistant for Cloud Pak for Data update for Netty
• Multiple vulnerabilities in Oracle Communications Messaging Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Helidon
• Multiple vulnerabilities in Oracle Coherence
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Red Hat OpenShift Logging
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• SUSE update for netty3
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Oracle Communications Design Studio
• Multiple vulnerabilities in Oracle Banking Platform
• Multiple vulnerabilities in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Red Hat Single Sign-On 7.5
• Red Hat Single Sign-On 7.5 on RHEL 8 update for keycloak
• Red Hat Single Sign-On 7.5 on RHEL 7 update for keycloak
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 on RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• IBM Operations Analytics Predictive Insights update for Netty
• Debian update for netty
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in Autodesk InfraWorks
• Multiple vulnerabilities in Dell CloudLink
• Ubuntu update for netty
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• openEuler update for netty
• openEuler 20.03 LTS SP3 update for netty
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in JBoss Data Grid 8.3
• Multiple vulnerabilities in AMQ Streams 2.1
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Knowledge Catalog