CVE-2021-43797 (CNNVD-202112-767)
中文标题:
Netty 环境问题漏洞
英文标题:
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
漏洞描述
中文描述:
Netty是Netty社区的一款非阻塞I/O客户端-服务器框架，它主要用于开发Java网络应用程序，如协议服务器和客户端等。 Netty 存在环境问题漏洞，该漏洞源于Netty是一个异步事件驱动的网络应用框架，用于快速开发可维护的高性能协议服务器和客户端。版本4.1.7.1之前的Netty。当控件字符出现在头名称的开头和结尾时，Final将跳过它们。相反，它应该很快失败，因为这是规范不允许的，可能会导致HTTP请求走私。如果没有进行验证，netty可能会在将这些头名称转发给另一个用作代理的远程系统之前对其进行“消毒”。这个远程系统无法再看到无效的使用，因此无法看到
英文描述:
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| netty | netty | <= 4.1.7.0.Final | - | - |
cpe:2.3:a:netty:netty:<=_4.1.7.0.final:*:*:*:*:*:*:*
|
| netty | netty | * | - | - |
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
|
| quarkus | quarkus | * | - | - |
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
|
| netapp | oncommand_workflow_automation | - | - | - |
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
|
| netapp | snapcenter | - | - | - |
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
|
| oracle | banking_deposits_and_lines_of_credit_servicing | 2.7 | - | - |
cpe:2.3:a:oracle:banking_deposits_and_lines_of_credit_servicing:2.7:*:*:*:*:*:*:*
|
| oracle | banking_party_management | 2.7.0 | - | - |
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
|
| oracle | banking_platform | 2.6.2 | - | - |
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
|
| oracle | coherence | 12.2.1.4.0 | - | - |
cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*
|
| oracle | coherence | 14.1.1.0.0 | - | - |
cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_binding_support_function | 1.11.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.11.0:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_network_slice_selection_function | 1.8.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.8.0:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_policy | 1.15.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*
|
| oracle | communications_cloud_native_core_unified_data_repository | 1.15.0 | - | - |
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.15.0:*:*:*:*:*:*:*
|
| oracle | communications_design_studio | 7.4.2 | - | - |
cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*
|
| oracle | communications_instant_messaging_server | 8.1 | - | - |
cpe:2.3:a:oracle:communications_instant_messaging_server:8.1:*:*:*:*:*:*:*
|
| oracle | helidon | 1.4.10 | - | - |
cpe:2.3:a:oracle:helidon:1.4.10:*:*:*:*:*:*:*
|
| oracle | helidon | 2.4.0 | - | - |
cpe:2.3:a:oracle:helidon:2.4.0:*:*:*:*:*:*:*
|
| oracle | peoplesoft_enterprise_peopletools | 8.58 | - | - |
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
|
| oracle | peoplesoft_enterprise_peopletools | 8.59 | - | - |
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
|
| debian | debian_linux | 10.0 | - | - |
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
|
| debian | debian_linux | 11.0 | - | - |
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2021-43797 |
2025-11-11 15:21:08 | 2025-11-11 07:37:05 |
| NVD | nvd_CVE-2021-43797 |
2025-11-11 14:57:46 | 2025-11-11 07:45:23 |
| CNNVD | cnnvd_CNNVD-202112-767 |
2025-11-11 15:10:46 | 2025-11-11 07:57:04 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 环境问题
- cnnvd_id: 未提取 -> CNNVD-202112-767
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 23
- data_sources: ['cve'] -> ['cve', 'nvd']