CVE-2021-21409

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) in maven/org.apache.zookeeper/zookeeper

Identifiers

CVE-2021-21409, GHSA-f256-j965-7f32, GHSA-wm47-8v5p-wjpj

Package Slug

maven/org.apache.zookeeper/zookeeper

Vulnerability

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)

Description

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2), which is used by zookeeper, there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case.

Affected Versions

Version 3.5.10

Solution

Upgrade to version 3.6.0 or above.

Last Modified

2021-04-23

source