HTTP Request Smuggling Affecting libdb-debuginfo package, versions <0:5.3.28-42.el8_4


Severity

Recommended
0.0
medium
0
10

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
0.28% (68th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ROCKY8-LIBDBDEBUGINFO-3273653
  • published3 Feb 2023
  • disclosed9 Dec 2021

Introduced: 9 Dec 2021

CVE-2021-43797  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:8 libdb-debuginfo to version 0:5.3.28-42.el8_4 or higher.
This issue was patched in RLSA-2022:5498.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libdb-debuginfo package and not the libdb-debuginfo package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:8 relevant fixed versions and status.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVSS Scores

version 3.1