Bug 1184203 - (CVE-2021-21409) VUL-0: CVE-2021-21409: netty: request smuggling via content-length header
(CVE-2021-21409)
VUL-0: CVE-2021-21409: netty: request smuggling via content-length header
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/280738/
CVSSv3.1:SUSE:CVE-2021-21409:6.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-03-31 08:06 UTC by Alexander Bergmann
Modified: 2022-09-15 13:29 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2021-03-31 08:06:00 UTC
CVE-2021-21409

Netty is an open-source, asynchronous event-driven network application framework
for rapid development of maintainable high performance protocol servers &
clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there
is a vulnerability that enables request smuggling. The content-length header is
not correctly validated if the request only uses a single Http2HeaderFrame with
the endStream set to to true. This could lead to request smuggling if the
request is proxied to a remote peer and translated to HTTP/1.1. This is a
followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one
case. This was fixed as part of 4.1.61.Final.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21409
https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21295
https://github.com/netty/netty/commit/b0fa4d5aab4215f3c22ce6123dd8dd5f38dc0432
https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32
Comment 2 Swamp Workflow Management 2022-04-22 19:25:25 UTC
SUSE-SU-2022:1315-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1184203
CVE References: CVE-2021-21409
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    netty-4.1.75-150200.4.9.1
openSUSE Leap 15.3 (src):    netty-4.1.75-150200.4.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 3 Hu 2022-08-12 12:02:15 UTC
This is still affected in:
- SUSE:SLE-15-SP2:Update:Products:Manager41:Update
- SUSE:SLE-15-SP3:Update:Products:Manager42:Update
- SUSE:SLE-15-SP4:Update:Products:Manager43:Update 

Not sure if the suma team handles this usually or the bugowner? CCing Julio from suma team
Comment 6 Thomas Florio 2022-09-15 13:22:24 UTC
As commented as well in https://bugzilla.suse.com/show_bug.cgi?id=1193672#c16 the package we ship with SUSE Manager is not affected by this CVE. This is in fact related to the netty module codec-http2, which we do not ship nor build. Please see the other comment for more pieces of information.
Comment 7 Thomas Leroy 2022-09-15 13:29:22 UTC
(In reply to Thomas Florio from comment #6)
> As commented as well in
> https://bugzilla.suse.com/show_bug.cgi?id=1193672#c16 the package we ship
> with SUSE Manager is not affected by this CVE. This is in fact related to
> the netty module codec-http2, which we do not ship nor build. Please see the
> other comment for more pieces of information.

Thanks Thomas. Closing