[KUDU-3313] There is a CVE-2021-21409 vulnerability in netty version 4.1.60

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.16.0
• Code Review: https://gerrit.cloudera.org/#/c/17828/
• Assignee: Unassigned
• Reporter: yejiabao_h
• Created: 04/Sep/21 07:21
• Updated: 07/Sep/21 17:26
• Resolved: 07/Sep/21 17:26

Description

In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.