Bugzilla – Bug 1184203
VUL-0: CVE-2021-21409: netty: request smuggling via content-length header
Last modified: 2022-09-15 13:29:22 UTC
Netty is an open-source, asynchronous event-driven network application framework
for rapid development of maintainable high performance protocol servers &
clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there
is a vulnerability that enables request smuggling. The content-length header is
not correctly validated if the request only uses a single Http2HeaderFrame with
the endStream set to to true. This could lead to request smuggling if the
request is proxied to a remote peer and translated to HTTP/1.1. This is a
followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one
case. This was fixed as part of 4.1.61.Final.
SUSE-SU-2022:1315-1: An update that fixes one vulnerability is now available.
Category: security (moderate)
Bug References: 1184203
CVE References: CVE-2021-21409
openSUSE Leap 15.4 (src): netty-4.1.75-150126.96.36.199
openSUSE Leap 15.3 (src): netty-4.1.75-150188.8.131.52
NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is still affected in:
Not sure if the suma team handles this usually or the bugowner? CCing Julio from suma team
As commented as well in https://bugzilla.suse.com/show_bug.cgi?id=1193672#c16 the package we ship with SUSE Manager is not affected by this CVE. This is in fact related to the netty module codec-http2, which we do not ship nor build. Please see the other comment for more pieces of information.
(In reply to Thomas Florio from comment #6)
> As commented as well in
> https://bugzilla.suse.com/show_bug.cgi?id=1193672#c16 the package we ship
> with SUSE Manager is not affected by this CVE. This is in fact related to
> the netty module codec-http2, which we do not ship nor build. Please see the
> other comment for more pieces of information.
Thanks Thomas. Closing