CVE-2021-43797
Publication date 9 December 2021
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Status
Package | Ubuntu Release | Status |
---|---|---|
netty | 24.10 oracular |
Vulnerable
|
24.04 LTS noble |
Vulnerable
|
|
22.04 LTS jammy |
Fixed 1:4.1.48-4+deb11u1build0.22.04.1
|
|
20.04 LTS focal |
Fixed 1:4.1.45-1ubuntu0.1~esm1
|
|
18.04 LTS bionic |
Fixed 1:4.1.7-4ubuntu0.1+esm2
|
|
16.04 LTS xenial |
Fixed 1:4.0.34-1ubuntu0.1~esm1
|
|
14.04 LTS trusty | Ignored end of ESM support, was needs-triage |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProSeverity score breakdown
Parameter | Value |
---|---|
Base score | 6.5 · Medium |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6049-1
- Netty vulnerabilities
- 28 April 2023