UBUNTU-CVE-2021-43797

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2021-43797

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-43797.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-43797

Related

Published

2021-12-09T19:15:00Z

Modified

2024-10-15T14:08:28Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

References

Affected packages

Ubuntu:Pro:14.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:3.*

1:3.2.6.Final-2

1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.0.34-1ubuntu0.1~esm1

Affected versions

1:3.*

1:3.2.6.Final-2

1:4.*

1:4.0.32-1

1:4.0.33-1

1:4.0.34-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1:4.0.34-1ubuntu0.1~esm1",
            "binary_name": "libnetty-java"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.1.7-4ubuntu0.1+esm2

Affected versions

1:4.*

1:4.1.7-4

1:4.1.7-4ubuntu0.1~esm1

1:4.1.7-4ubuntu0.1

1:4.1.7-4ubuntu0.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1:4.1.7-4ubuntu0.1+esm2",
            "binary_name": "libnetty-java"
        }
    ]
}

Ubuntu:20.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.33-1

1:4.1.33-2

1:4.1.33-3

1:4.1.45-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.1.45-1ubuntu0.1~esm1

Affected versions

1:4.*

1:4.1.33-1

1:4.1.33-2

1:4.1.33-3

1:4.1.45-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1:4.1.45-1ubuntu0.1~esm1",
            "binary_name": "libnetty-java"
        }
    ]
}

Ubuntu:22.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.1.48-4+deb11u1build0.22.04.1

Affected versions

1:4.*

1:4.1.48-4

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1:4.1.48-4+deb11u1build0.22.04.1",
            "binary_name": "libnetty-java"
        }
    ]
}

Ubuntu:24.10 / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.48-9

1:4.1.48-10

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / netty

Package

Name: netty
Purl: pkg:deb/ubuntu/netty?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.48-7

1:4.1.48-8

1:4.1.48-9

Ecosystem specific

{
    "ubuntu_priority": "medium"
}