CVE-2021-21409, GHSA-f256-j965-7f32, GHSA-wm47-8v5p-wjpj
maven/org.apache.zookeeper/zookeeper
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2
), which is used by zookeeper, there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame
with the endStream
set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case.
Version 3.5.10
Upgrade to version 3.6.0 or above.
2021-04-23
source |