NetSight
IP …
medium5.9

CVE-2021-21409

Possible request smuggling in HTTP/2 due missing validation of content-length

Impact

### Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1 This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case. ### Patches This was fixed as part of 4.1.61.Final ### Workarounds Validation can be done by the user before proxy the request by validating the header.

Affected packages

EcosystemPackageAffectedFixed in
mavenio.netty:netty-codec-http2>= 4.0.0, < 4.1.61.Final4.1.61.Final
mavenorg.jboss.netty:netty< 4.0.0none recorded
mavenio.netty:netty< 4.0.0none recorded

Affected products

VendorProductAffected versions
NettyNetty
before 4.1.61
DebianDebian Linux
Version 10.0
NetappOncommand Api Services
All versions
NetappOncommand Workflow Automation
All versions
OracleBanking Corporate Lending Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Credit Facilities Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleBanking Trade Finance Process Management
Versions 14.2.0, 14.3.0, 14.5.0
OracleCoherence
Versions 12.2.1.4.0, 14.1.1.0.0
OracleCommunications Brm - Elastic Charging Engine
Version 12.0.0.3
OracleCommunications Cloud Native Core Console
Version 1.7.0
OracleCommunications Cloud Native Core Policy
Version 1.14.0
OracleCommunications Design Studio
Version 7.4.2.0.0

Weakness classification

CWE-444

References