VDB
RHSA-2021%3A5128
RHSA-2021%3A5128
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in Netty. There is an issue where the content-length header is not validated correctly if the request uses a single Http2HeaderFrame with the endstream set to true. This flaw leads to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. The highest threat from this vulnerability is to integrity.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:551c671792f1d97cf00b1c52b8645d6aa734655bc834f280013408e2d6101b81_amd64 as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:b3cdddf65666934636aa6a6a7cf3c9f00d4f793cfb0b9eef8e0aacf04b6fb7c0_ppc64le as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:09eb62fb9c67251f67cf13bbd840c274d879285cb3151e4540df5c9e286debff_s390x as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:8a21d9ea3bcc997ddaa38cf7115b8ad982d9e019beece3dd52a027aeaf211c3e_ppc64le as a component of OpenShift Logging 5.1 | openshift-logging/fluentd-rhel8@sha256:8a21d9ea3bcc997ddaa38cf7115b8ad982d9e019beece3dd52a027aeaf211c3e_ppc64le |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:c57ce065696844f5c5d0e09969d228f79423b2d1d2f97a5a539c87fb3de63793_ppc64le as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/cluster-logging-operator-bundle@sha256:9ff35e6d560796a50b470c75ba6862cc79c6d9e30074e4a3f2c606fae3722956_amd64 as a component of OpenShift Logging 5.1 | openshift-logging/cluster-logging-operator-bundle@sha256:9ff35e6d560796a50b470c75ba6862cc79c6d9e30074e4a3f2c606fae3722956_amd64 |
| Red Hat | openshift-logging/elasticsearch6-rhel8@sha256:fca86030c0886e0c41d4000d4907e6a58717b95c206d34dba5197d44aa8d6d02_ppc64le as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:f68496878ed86375e0d28d4b01d1686e1af078582710576fcb8a1a4b7c6ec20f_amd64 as a component of OpenShift Logging 5.1 | openshift-logging/kibana6-rhel8@sha256:f68496878ed86375e0d28d4b01d1686e1af078582710576fcb8a1a4b7c6ec20f_amd64 |
| Red Hat | openshift-logging/elasticsearch-operator-bundle@sha256:862602f0b5cf3dc1bdd69f236d09a4bf1630fdd77e7faf30a1f4858558360202_amd64 as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/elasticsearch-rhel8-operator@sha256:2467fb3d733e318b3ce1474301361af0247580b7abf9b8b2d3482707d0272949_ppc64le as a component of OpenShift Logging 5.1 | openshift-logging/elasticsearch-rhel8-operator@sha256:2467fb3d733e318b3ce1474301361af0247580b7abf9b8b2d3482707d0272949_ppc64le |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:760f9ed42e7634fc246fc638985802d84df561d87c80628ba7bf7db8543e0007_s390x as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:623dd6d9c57ed7c44e57f5f7ddfbc5b16dc986b86a20188781ebefdde9f87f0d_amd64 as a component of OpenShift Logging 5.1 | openshift-logging/fluentd-rhel8@sha256:623dd6d9c57ed7c44e57f5f7ddfbc5b16dc986b86a20188781ebefdde9f87f0d_amd64 |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:2d9f4a1319755cdfdf5e1cf8bd7a12edc6e17b5a85fef5f10a067e5a936a095b_s390x as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:b85c8866c068409bee0b7f162e3a5f04c075c221d04bc7f6347ca3f9e022840a_amd64 as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:f68496878ed86375e0d28d4b01d1686e1af078582710576fcb8a1a4b7c6ec20f_amd64 as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/elasticsearch6-rhel8@sha256:fca86030c0886e0c41d4000d4907e6a58717b95c206d34dba5197d44aa8d6d02_ppc64le as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:70aca191fa4fe95e857f8cba3925d88e9965e8c868c6362e00ad0ce912360a99_ppc64le as a component of OpenShift Logging 5.1 | openshift-logging/cluster-logging-rhel8-operator@sha256:70aca191fa4fe95e857f8cba3925d88e9965e8c868c6362e00ad0ce912360a99_ppc64le |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:b85c8866c068409bee0b7f162e3a5f04c075c221d04bc7f6347ca3f9e022840a_amd64 as a component of OpenShift Logging 5.1 | openshift-logging/eventrouter-rhel8@sha256:b85c8866c068409bee0b7f162e3a5f04c075c221d04bc7f6347ca3f9e022840a_amd64 |
| Red Hat | openshift-logging/cluster-logging-operator-bundle@sha256:9ff35e6d560796a50b470c75ba6862cc79c6d9e30074e4a3f2c606fae3722956_amd64 as a component of OpenShift Logging 5.1 | * |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:551c671792f1d97cf00b1c52b8645d6aa734655bc834f280013408e2d6101b81_amd64 as a component of OpenShift Logging 5.1 | openshift-logging/elasticsearch-proxy-rhel8@sha256:551c671792f1d97cf00b1c52b8645d6aa734655bc834f280013408e2d6101b81_amd64 |
…and 26 more
Timeline
- Dec 10, 2021 PoC Published
- Dec 14, 2021 CVE Published
- Feb 13, 2025 PoC Published
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Distribution Patch
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- Apr 28, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2021:5128 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2021-009 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1944888 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2004133 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2004135 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2030932 issue
- https://issues.redhat.com/browse/LOG-1971 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5128.json advisory
- https://access.redhat.com/security/cve/CVE-2021-21409 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-21409 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-21409 advisory
- https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32 advisory
- https://access.redhat.com/security/cve/CVE-2021-37136 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-37136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-37136 advisory
- https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv advisory
- https://access.redhat.com/security/cve/CVE-2021-37137 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-37137 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-37137 advisory
…and 12 more