CVSS 5.9 · Medium EPSS 4,9%
Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada netty, debian linux +16 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| netty | netty | Semua versi sebelum 4.1.61 |
| debian | debian linux | Versi 10.0 |
| netapp | oncommand api services | Semua versi |
| netapp | oncommand workflow automation | Semua versi |
| oracle | banking corporate lending process management | Versi 14.2.0 |
| oracle | banking corporate lending process management | Versi 14.3.0 |
| oracle | banking corporate lending process management | Versi 14.5.0 |
| oracle | banking credit facilities process management | Versi 14.2.0 |
| oracle | banking credit facilities process management | Versi 14.3.0 |
| oracle | banking credit facilities process management | Versi 14.5.0 |
| oracle | banking trade finance process management | Versi 14.2.0 |
| oracle | banking trade finance process management | Versi 14.3.0 |
| oracle | banking trade finance process management | Versi 14.5.0 |
| oracle | coherence | Versi 12.2.1.4.0 |
| oracle | coherence | Versi 14.1.1.0.0 |
| oracle | communications brm - elastic charging engine | Versi 12.0.0.3 |
| oracle | communications cloud native core console | Versi 1.7.0 |
| oracle | communications cloud native core policy | Versi 1.14.0 |
| oracle | communications design studio | Versi 7.4.2.0.0 |
| oracle | communications messaging server | Versi 8.1 |
| oracle | helidon | Versi 1.4.10 |
| oracle | helidon | Versi 2.4.0 |
| oracle | jd edwards enterpriseone tools | Semua versi sebelum 9.2.6.3 |
| oracle | nosql database | Semua versi sebelum 21.1.12 |
| oracle | primavera gateway | Versi 17.12.0 hingga 17.12.11 |
| oracle | primavera gateway | Versi 18.8.0 hingga 18.8.11 |
| oracle | primavera gateway | Versi 19.12.0 hingga 19.12.10 |
| quarkus | quarkus | Semua versi hingga 1.13.7 |