Cyber Resilience

CVE-2021-21409

Medium

Published: 30 March 2021

Published
30 March 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0316 87.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-21409 is a medium-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Oracle Banking Corporate Lending Process Management. Its CVSS base score is 5.9 (Medium).

Operationally, ranked in the top 12.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly…

more

validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

netty
netty
≤ 4.1.61
debian
debian linux
10.0
netapp
oncommand api services
all versions
netapp
oncommand workflow automation
all versions
oracle
banking corporate lending process management
14.2.0, 14.3.0, 14.5.0
oracle
banking credit facilities process management
14.2.0, 14.3.0, 14.5.0
oracle
banking trade finance process management
14.2.0, 14.3.0, 14.5.0
oracle
coherence
12.2.1.4.0, 14.1.1.0.0
oracle
communications brm - elastic charging engine
12.0.0.3
oracle
communications cloud native core console
1.7.0
+8 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References