CVE-2021-21290: Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Published Feb 8, 2021
·
Updated

Impact

When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.

The CVSSv3.1 score of this vulnerability is calculated to be a 6.2/10

Vulnerability Details

On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems.

The method File.createTempFile on unix-like systems creates a random file, but, by default will create this file with the permissions -rw-r--r--. Thus, if sensitive information is written to this file, other local users can read this information.

This is the case in netty's AbstractDiskHttpData is vulnerable.

https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java#L80-L101

AbstractDiskHttpData is used as a part of the DefaultHttpDataFactory class which is used by HttpPostRequestDecoder / HttpPostMultiPartRequestDecoder.

You may be affected by this vulnerability your project contains the following code patterns:

java channelPipeline.addLast(new HttpPostRequestDecoder(...));

java channelPipeline.addLast(new HttpPostMultiPartRequestDecoder(...));

Patches

This has been patched in version 4.1.59.Final.

Workarounds

Specify your own java.io.tmpdir when you start the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

References

- CWE-378: Creation of Temporary File With Insecure Permissions - CWE-379: Creation of Temporary File in Directory with Insecure Permissions

Similar Vulnerabilities

Similar, but not the same.

- JUnit 4 - https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp - Google Guava - https://github.com/google/guava/issues/4011 - Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945 - JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824

For more information If you have any questions or comments about this advisory: Open an issue in netty Email us here

Original Report

> Hi Netty Security Team, > > I've been working on some security research leveraging custom CodeQL queries to detect local information disclosure vulnerabilities in java applications. This was the result from running this query against the netty project: > https://lgtm.com/query/7723301787255288599/ > > Netty contains three local information disclosure vulnerabilities, so far as I can tell. > > One is here, where the private key for the certificate is written to a temporary file. > > https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L316-L346 > > One is here, where the certificate is written to a temporary file. > > https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/handler/src/main/java/io/netty/handler/ssl/util/SelfSignedCertificate.java#L348-L371 > > The final one is here, where the 'AbstractDiskHttpData' creates a temporary file if the getBaseDirectory() method returns null. I believe that 'AbstractDiskHttpData' is used as a part of the file upload support? If this is the case, any files uploaded would be similarly vulnerable. > > https://github.com/netty/netty/blob/e5951d46fc89db507ba7d2968d2ede26378f0b04/codec-http/src/main/java/io/netty/handler/codec/http/multipart/AbstractDiskHttpData.java#L91 > > All of these vulnerabilities exist because File.createTempFile(String, String) will create a temporary file in the system temporary directory if the 'java.io.tmpdir' system property is not explicitly set. It is my understanding that when java creates a file, by default, and using this method, the permissions on that file utilize the umask. In a majority of cases, this means that the file that java creates has the permissions: -rw-r--r--, thus, any other local user on that system can read the contents of that file. > > Impacted OS: > - Any OS where the system temporary directory is shared between multiple users. This is not the case for MacOS or Windows. > > Mitigation. > > Moving to the Files API instead will fix this vulnerability. > https://docs.oracle.com/javase/8/docs/api/java/nio/file/Files.html#createTempFile-java.nio.file.Path-java.lang.String-java.lang.String-java.nio.file.attribute.FileAttribute...- > > This API will explicitly set the posix file permissions to something safe, by default. > > I recently disclosed a similar vulnerability in JUnit 4: > https://github.com/junit-team/junit4/security/advisories/GHSA-269g-pwp5-87pp > > If you're also curious, this vulnerability in Jetty was also mine, also involving temporary directories, but is not the same vulnerability as in this case. > https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6 > > I would appreciate it if we could perform disclosure of this vulnerability leveraging the GitHub security advisories feature here. GitHub has a nice credit system that I appreciate, plus the disclosures, as you can see from the sampling above, end up looking very nice. > https://github.com/netty/netty/security/advisories > > This vulnerability disclosure follows Google's 90-day vulnerability disclosure policy (I'm not an employee of Google, I just like their policy). Full disclosure will occur either at the end of the 90-day deadline or whenever a patch is made widely available, whichever occurs first. > > Cheers, > Jonathan Leitschuh

Other sources

In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

References:

https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2

— Red Hat

In Netty there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used, a local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure.

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

Affected Software

92 affected componentsFixes available
maven/io.netty:netty<4.0.0
maven/org.jboss.netty:netty<4.0.0
maven/io.netty:netty-codec-http>=4.0.0<4.1.59.Final
4.1.59.Final
redhat/qpid-proton<0:0.33.0-6.el7_9
0:0.33.0-6.el7_9
redhat/qpid-proton<0:0.33.0-8.el8
0:0.33.0-8.el8
redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el6ea
0:1.0.4-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.68.0-2.redhat_00005.1.el6ea
0:1.68.0-2.redhat_00005.1.el6ea
redhat/eap7-hal-console<0:3.2.14-1.Final_redhat_00001.1.el6ea
0:3.2.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.4.22-3.Final_redhat_00001.1.el6ea
0:9.4.22-3.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.30-1.Final_redhat_00001.1.el6ea
0:1.4.30-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-genericjms<0:2.0.9-1.Final_redhat_00001.1.el6ea
0:2.0.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-marshalling<0:2.0.11-1.Final_redhat_00001.1.el6ea
0:2.0.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-6.Final_redhat_00007.1.el6ea
0:1.7.2-6.Final_redhat_00007.1.el6ea
redhat/eap7-jboss-weld<3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6ea
3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6ea
redhat/eap7-jgroups-kubernetes<0:1.0.16-1.Final_redhat_00001.1.el6ea
0:1.0.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-netty<0:4.1.60-1.Final_redhat_00001.1.el6ea
0:4.1.60-1.Final_redhat_00001.1.el6ea
redhat/eap7-resteasy<0:3.11.4-1.Final_redhat_00001.1.el6ea
0:3.11.4-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.35-1.SP1_redhat_00001.1.el6ea
0:2.0.35-1.SP1_redhat_00001.1.el6ea
redhat/eap7-velocity<0:2.3.0-1.redhat_00001.1.el6ea
0:2.3.0-1.redhat_00001.1.el6ea
redhat/eap7-weld-core<0:3.1.6-1.Final_redhat_00001.1.el6ea
0:3.1.6-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.7-1.GA_redhat_00002.1.el6ea
0:7.3.7-1.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.12-1.Final_redhat_00001.1.el6ea
0:1.10.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.26-1.Final_redhat_00001.1.el6ea
0:1.0.26-1.Final_redhat_00001.1.el6ea
redhat/eap7-xalan-j2<0:2.7.1-36.redhat_00013.1.el6ea
0:2.7.1-36.redhat_00013.1.el6ea
redhat/eap7-yasson<0:1.0.9-1.redhat_00001.1.el6ea
0:1.0.9-1.redhat_00001.1.el6ea
redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el7ea
0:1.0.4-1.redhat_00001.1.el7ea
redhat/eap7-bouncycastle<0:1.68.0-2.redhat_00005.1.el7ea
0:1.68.0-2.redhat_00005.1.el7ea
redhat/eap7-hal-console<0:3.2.14-1.Final_redhat_00001.1.el7ea
0:3.2.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-infinispan<0:9.4.22-3.Final_redhat_00001.1.el7ea
0:9.4.22-3.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.30-1.Final_redhat_00001.1.el7ea
0:1.4.30-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-genericjms<0:2.0.9-1.Final_redhat_00001.1.el7ea
0:2.0.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-marshalling<0:2.0.11-1.Final_redhat_00001.1.el7ea
0:2.0.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-6.Final_redhat_00007.1.el7ea
0:1.7.2-6.Final_redhat_00007.1.el7ea
redhat/eap7-jboss-weld<3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7ea
3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7ea
redhat/eap7-jgroups-kubernetes<0:1.0.16-1.Final_redhat_00001.1.el7ea
0:1.0.16-1.Final_redhat_00001.1.el7ea
redhat/eap7-netty<0:4.1.60-1.Final_redhat_00001.1.el7ea
0:4.1.60-1.Final_redhat_00001.1.el7ea
redhat/eap7-resteasy<0:3.11.4-1.Final_redhat_00001.1.el7ea
0:3.11.4-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.35-1.SP1_redhat_00001.1.el7ea
0:2.0.35-1.SP1_redhat_00001.1.el7ea
redhat/eap7-velocity<0:2.3.0-1.redhat_00001.1.el7ea
0:2.3.0-1.redhat_00001.1.el7ea
redhat/eap7-weld-core<0:3.1.6-1.Final_redhat_00001.1.el7ea
0:3.1.6-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.7-1.GA_redhat_00002.1.el7ea
0:7.3.7-1.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.12-1.Final_redhat_00001.1.el7ea
0:1.10.12-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.26-1.Final_redhat_00001.1.el7ea
0:1.0.26-1.Final_redhat_00001.1.el7ea
redhat/eap7-xalan-j2<0:2.7.1-36.redhat_00013.1.el7ea
0:2.7.1-36.redhat_00013.1.el7ea
redhat/eap7-yasson<0:1.0.9-1.redhat_00001.1.el7ea
0:1.0.9-1.redhat_00001.1.el7ea
redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el8ea
0:1.0.4-1.redhat_00001.1.el8ea
redhat/eap7-bouncycastle<0:1.68.0-2.redhat_00005.1.el8ea
0:1.68.0-2.redhat_00005.1.el8ea
redhat/eap7-hal-console<0:3.2.14-1.Final_redhat_00001.1.el8ea
0:3.2.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-infinispan<0:9.4.22-3.Final_redhat_00001.1.el8ea
0:9.4.22-3.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.30-1.Final_redhat_00001.1.el8ea
0:1.4.30-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-genericjms<0:2.0.9-1.Final_redhat_00001.1.el8ea
0:2.0.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-marshalling<0:2.0.11-1.Final_redhat_00001.1.el8ea
0:2.0.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-6.Final_redhat_00007.1.el8ea
0:1.7.2-6.Final_redhat_00007.1.el8ea
redhat/eap7-jboss-weld<3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8ea
3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8ea
redhat/eap7-jgroups-kubernetes<0:1.0.16-1.Final_redhat_00001.1.el8ea
0:1.0.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.60-1.Final_redhat_00001.1.el8ea
0:4.1.60-1.Final_redhat_00001.1.el8ea
redhat/eap7-resteasy<0:3.11.4-1.Final_redhat_00001.1.el8ea
0:3.11.4-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.35-1.SP1_redhat_00001.1.el8ea
0:2.0.35-1.SP1_redhat_00001.1.el8ea
redhat/eap7-velocity<0:2.3.0-1.redhat_00001.1.el8ea
0:2.3.0-1.redhat_00001.1.el8ea
redhat/eap7-weld-core<0:3.1.6-1.Final_redhat_00001.1.el8ea
0:3.1.6-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.7-1.GA_redhat_00002.1.el8ea
0:7.3.7-1.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.12-1.Final_redhat_00001.1.el8ea
0:1.10.12-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.26-1.Final_redhat_00001.1.el8ea
0:1.0.26-1.Final_redhat_00001.1.el8ea
redhat/eap7-xalan-j2<0:2.7.1-36.redhat_00013.1.el8ea
0:2.7.1-36.redhat_00013.1.el8ea
redhat/eap7-yasson<0:1.0.9-1.redhat_00001.1.el8ea
0:1.0.9-1.redhat_00001.1.el8ea
redhat/satellite<0:6.10.2-1.el7
0:6.10.2-1.el7
redhat/candlepin<0:4.1.13-1.el7
0:4.1.13-1.el7
redhat/candlepin<0:4.1.13-1.el8
0:4.1.13-1.el8
redhat/netty-codec-http<4.1.59.
4.1.59.
debian/netty
1:4.1.48-4+deb11u21:4.1.48-7+deb12u11:4.1.48-10
Netty Netty<4.1.59
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Quarkus Quarkus<=1.13.7
Oracle Banking Corporate Lending Process Management=14.2.0
Oracle Banking Corporate Lending Process Management=14.3.0
Oracle Banking Corporate Lending Process Management=14.5.0
Oracle Banking Credit Facilities Process Management=14.2.0
Oracle Banking Credit Facilities Process Management=14.3.0
Oracle Banking Credit Facilities Process Management=14.5.0
Oracle Banking Trade Finance Process Management=14.2.0
Oracle Banking Trade Finance Process Management=14.3.0
Oracle Banking Trade Finance Process Management=14.5.0
Oracle Communications Brm - Elastic Charging Engine=12.0.0.3
Oracle Communications Design Studio=7.4.2
Oracle Communications Messaging Server=8.1
Oracle Nosql Database<20.3
NetApp Active Iq Unified Manager Linux
NetApp Active Iq Unified Manager Windows
NetApp Cloud Secure Agent
NetApp Snapcenter
IBM watsonx.data intelligence<=5.2.0, 5.2.1, 5.2.2, 5.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/io.netty:netty-codec-http to a version that resolves this vulnerability.

    Fixed in 4.1.59.Final
  2. Upgrade

    Upgrade redhat/qpid-proton to a version that resolves this vulnerability.

    Fixed in 0:0.33.0-6.el7_9
  3. Upgrade

    Upgrade redhat/qpid-proton to a version that resolves this vulnerability.

    Fixed in 0:0.33.0-8.el8
  4. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.4-1.redhat_00001.1.el6ea
  5. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-2.redhat_00005.1.el6ea
  6. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.14-1.Final_redhat_00001.1.el6ea
  7. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:9.4.22-3.Final_redhat_00001.1.el6ea
  8. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.30-1.Final_redhat_00001.1.el6ea
  9. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.9-1.Final_redhat_00001.1.el6ea
  10. Upgrade

    Upgrade redhat/eap7-jboss-marshalling to a version that resolves this vulnerability.

    Fixed in 0:2.0.11-1.Final_redhat_00001.1.el6ea
  11. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-6.Final_redhat_00007.1.el6ea
  12. Upgrade

    Upgrade redhat/eap7-jboss-weld to a version that resolves this vulnerability.

    Fixed in 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6ea
  13. Upgrade

    Upgrade redhat/eap7-jgroups-kubernetes to a version that resolves this vulnerability.

    Fixed in 0:1.0.16-1.Final_redhat_00001.1.el6ea
  14. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.60-1.Final_redhat_00001.1.el6ea
  15. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.4-1.Final_redhat_00001.1.el6ea
  16. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.35-1.SP1_redhat_00001.1.el6ea
  17. Upgrade

    Upgrade redhat/eap7-velocity to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1.redhat_00001.1.el6ea
  18. Upgrade

    Upgrade redhat/eap7-weld-core to a version that resolves this vulnerability.

    Fixed in 0:3.1.6-1.Final_redhat_00001.1.el6ea
  19. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.7-1.GA_redhat_00002.1.el6ea
  20. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.12-1.Final_redhat_00001.1.el6ea
  21. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.Final_redhat_00001.1.el6ea
  22. Upgrade

    Upgrade redhat/eap7-xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-36.redhat_00013.1.el6ea
  23. Upgrade

    Upgrade redhat/eap7-yasson to a version that resolves this vulnerability.

    Fixed in 0:1.0.9-1.redhat_00001.1.el6ea
  24. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.4-1.redhat_00001.1.el7ea
  25. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-2.redhat_00005.1.el7ea
  26. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.14-1.Final_redhat_00001.1.el7ea
  27. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:9.4.22-3.Final_redhat_00001.1.el7ea
  28. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.30-1.Final_redhat_00001.1.el7ea
  29. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.9-1.Final_redhat_00001.1.el7ea
  30. Upgrade

    Upgrade redhat/eap7-jboss-marshalling to a version that resolves this vulnerability.

    Fixed in 0:2.0.11-1.Final_redhat_00001.1.el7ea
  31. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-6.Final_redhat_00007.1.el7ea
  32. Upgrade

    Upgrade redhat/eap7-jboss-weld to a version that resolves this vulnerability.

    Fixed in 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7ea
  33. Upgrade

    Upgrade redhat/eap7-jgroups-kubernetes to a version that resolves this vulnerability.

    Fixed in 0:1.0.16-1.Final_redhat_00001.1.el7ea
  34. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.60-1.Final_redhat_00001.1.el7ea
  35. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.4-1.Final_redhat_00001.1.el7ea
  36. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.35-1.SP1_redhat_00001.1.el7ea
  37. Upgrade

    Upgrade redhat/eap7-velocity to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1.redhat_00001.1.el7ea
  38. Upgrade

    Upgrade redhat/eap7-weld-core to a version that resolves this vulnerability.

    Fixed in 0:3.1.6-1.Final_redhat_00001.1.el7ea
  39. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.7-1.GA_redhat_00002.1.el7ea
  40. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.12-1.Final_redhat_00001.1.el7ea
  41. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.Final_redhat_00001.1.el7ea
  42. Upgrade

    Upgrade redhat/eap7-xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-36.redhat_00013.1.el7ea
  43. Upgrade

    Upgrade redhat/eap7-yasson to a version that resolves this vulnerability.

    Fixed in 0:1.0.9-1.redhat_00001.1.el7ea
  44. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.4-1.redhat_00001.1.el8ea
  45. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-2.redhat_00005.1.el8ea
  46. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.14-1.Final_redhat_00001.1.el8ea
  47. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:9.4.22-3.Final_redhat_00001.1.el8ea
  48. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.30-1.Final_redhat_00001.1.el8ea
  49. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.9-1.Final_redhat_00001.1.el8ea
  50. Upgrade

    Upgrade redhat/eap7-jboss-marshalling to a version that resolves this vulnerability.

    Fixed in 0:2.0.11-1.Final_redhat_00001.1.el8ea
  51. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-6.Final_redhat_00007.1.el8ea
  52. Upgrade

    Upgrade redhat/eap7-jboss-weld to a version that resolves this vulnerability.

    Fixed in 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8ea
  53. Upgrade

    Upgrade redhat/eap7-jgroups-kubernetes to a version that resolves this vulnerability.

    Fixed in 0:1.0.16-1.Final_redhat_00001.1.el8ea
  54. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.60-1.Final_redhat_00001.1.el8ea
  55. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.4-1.Final_redhat_00001.1.el8ea
  56. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.35-1.SP1_redhat_00001.1.el8ea
  57. Upgrade

    Upgrade redhat/eap7-velocity to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1.redhat_00001.1.el8ea
  58. Upgrade

    Upgrade redhat/eap7-weld-core to a version that resolves this vulnerability.

    Fixed in 0:3.1.6-1.Final_redhat_00001.1.el8ea
  59. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.7-1.GA_redhat_00002.1.el8ea
  60. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.12-1.Final_redhat_00001.1.el8ea
  61. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.Final_redhat_00001.1.el8ea
  62. Upgrade

    Upgrade redhat/eap7-xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-36.redhat_00013.1.el8ea
  63. Upgrade

    Upgrade redhat/eap7-yasson to a version that resolves this vulnerability.

    Fixed in 0:1.0.9-1.redhat_00001.1.el8ea
  64. Upgrade

    Upgrade redhat/satellite to a version that resolves this vulnerability.

    Fixed in 0:6.10.2-1.el7
  65. Upgrade

    Upgrade redhat/candlepin to a version that resolves this vulnerability.

    Fixed in 0:4.1.13-1.el7
  66. Upgrade

    Upgrade redhat/candlepin to a version that resolves this vulnerability.

    Fixed in 0:4.1.13-1.el8
  67. Upgrade

    Upgrade redhat/netty-codec-http to a version that resolves this vulnerability.

    Fixed in 4.1.59.
  68. Upgrade

    Upgrade debian/netty to a version that resolves this vulnerability.

    Fixed in 1:4.1.48-4+deb11u2Fixed in 1:4.1.48-7+deb12u1Fixed in 1:4.1.48-10
  69. Upgrade

    Upgrade netty to a version that resolves this vulnerability.

    Fixed in 4.1.59.Final
  70. Configuration

    As a workaround, specify your own "java.io.tmpdir" when you start the JVM so Netty writes temporary files to a directory only readable by the current user.

    JVM (system property) java.io.tmpdir = set to a directory only readable by the current user
  71. Configuration

    As a workaround, use "DefaultHttpDataFactory.setBaseDir(...)" to set the base directory to something only readable by the current user.

    Netty DefaultHttpDataFactory setBaseDir(...) (base directory) = setBaseDir(...) to a directory only readable by the current user

Event History

Feb 8, 2021
CVE Published
via MITRE·08:10 PM
Data Sourced
via MITRE·08:10 PM
DescriptionSeverityWeakness
Advisory Published
09:17 PM
Jan 11, 2024
Data Sourced
via Launchpad·11:54 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·02:30 AM
RemedyDescriptionSeverityAffected Software
Jun 24, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-21290?

The severity of CVE-2021-21290 is rated at a CVSSv3.1 score of 6.2 out of 10.

2

How do I fix CVE-2021-21290?

To fix CVE-2021-21290, upgrade to Netty version 4.1.59.Final or later.

3

What software is affected by CVE-2021-21290?

CVE-2021-21290 affects versions of Netty up to 4.0.0 and related packages that utilize multipart decoders.

4

What type of vulnerability is CVE-2021-21290?

CVE-2021-21290 is classified as a local information disclosure vulnerability.

5

What can be compromised due to CVE-2021-21290?

CVE-2021-21290 may lead to the exposure of sensitive data stored in the local system's temporary directory.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203