CVE-2021-21290 (CNNVD-202102-612)

MEDIUM
中文标题:
Netty 安全漏洞
英文标题:
Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
CVSS分数: 6.2
发布时间: 2021-02-08 20:10:16
漏洞类型: 其他
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Netty是Netty社区的一款非阻塞I/O客户端-服务器框架，它主要用于开发Java网络应用程序，如协议服务器和客户端等。 Netty 4.1.59之前版本存在安全漏洞，该漏洞源于当netty的多部分解码器被使用时，如果磁盘上的临时存储被启用，则本地信息可以通过本地系统临时目录进行公开。在类unix系统中，所有用户共享临时目录。因此，使用没有显式设置文件/目录权限的api写入该目录可能导致信息泄露。值得注意的是，这并不影响现代的MacOS操作系统。法”文件。createTempFile"在类unix系统上创建一个随机文件，但默认情况下将创建这个文件，权限为"-rw-r——r——"。因此，如果将敏感信息写入该文件，其他本地用户就可以读取该信息。

英文描述:

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

CWE类型:
CWE-668 CWE-379 CWE-378
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
netty netty < 4.1.59.Final - - cpe:2.3:a:netty:netty:<_4.1.59.final:*:*:*:*:*:*:*
netty netty * - - cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
debian debian_linux 9.0 - - cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
debian debian_linux 10.0 - - cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
quarkus quarkus * - - cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
oracle banking_corporate_lending_process_management 14.2.0 - - cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*
oracle banking_corporate_lending_process_management 14.3.0 - - cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*
oracle banking_corporate_lending_process_management 14.5.0 - - cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*
oracle banking_credit_facilities_process_management 14.2.0 - - cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*
oracle banking_credit_facilities_process_management 14.3.0 - - cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*
oracle banking_credit_facilities_process_management 14.5.0 - - cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*
oracle banking_trade_finance_process_management 14.2.0 - - cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*
oracle banking_trade_finance_process_management 14.3.0 - - cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*
oracle banking_trade_finance_process_management 14.5.0 - - cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*
oracle communications_brm_-_elastic_charging_engine 12.0.0.3 - - cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
oracle communications_design_studio 7.4.2 - - cpe:2.3:a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*
oracle communications_messaging_server 8.1 - - cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*
oracle nosql_database * - - cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*
netapp active_iq_unified_manager - - - cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
netapp cloud_secure_agent - - - cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*
netapp snapcenter - - - cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[debian-lts-announce] 20210211 [SECURITY] [DLA 2555-1] netty security update mailing-list
cve.org
访问
[kafka-jira] 20210301 [jira] [Created] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-dev] 20210301 [jira] [Created] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-jira] 20210301 [jira] [Assigned] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-jira] 20210301 [GitHub] [kafka] dongjinleekr opened a new pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-jira] 20210301 [GitHub] [kafka] dongjinleekr commented on pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-dev] 20210302 [jira] [Resolved] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-jira] 20210302 [jira] [Resolved] (KAFKA-12389) Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-jira] 20210302 [GitHub] [kafka] omkreddy closed pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-commits] 20210302 [kafka] branch 2.6 updated: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-commits] 20210302 [kafka] branch 2.7 updated: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[kafka-jira] 20210302 [GitHub] [kafka] dongjinleekr commented on pull request #10235: KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290 mailing-list
cve.org
访问
[zookeeper-issues] 20210311 [jira] [Created] (ZOOKEEPER-4242) Upgrade Netty library to > 4.1.59 due to security vulnerability mailing-list
cve.org
访问
[zookeeper-dev] 20210311 [jira] [Created] (ZOOKEEPER-4242) Upgrade Netty library to > 4.1.59 due to security vulnerability mailing-list
cve.org
访问
[tinkerpop-dev] 20210316 [jira] [Created] (TINKERPOP-2535) Netty 4.1.52 flagged as medium security violation mailing-list
cve.org
访问
[ranger-dev] 20210317 [jira] [Created] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 mailing-list
cve.org
访问
[ranger-dev] 20210317 [jira] [Assigned] (RANGER-3209) Upgrade netty to 4.1.60+ due to CVE-2021-21290 and CVE-2021-21295 mailing-list
cve.org
访问
[pulsar-commits] 20210329 [GitHub] [pulsar] yaswanthnadella opened a new issue #10071: CVE-2021-21295 & CVE-2021-21290 mailing-list
cve.org
访问
[pulsar-commits] 20210329 [GitHub] [pulsar] aahmed-se opened a new pull request #10073: Upgrade Netty version to 4.1.60.final mailing-list
cve.org
访问
[pulsar-commits] 20210329 [GitHub] [pulsar] merlimat closed issue #10071: CVE-2021-21295 & CVE-2021-21290 mailing-list
cve.org
访问
[bookkeeper-issues] 20210330 [GitHub] [bookkeeper] eolivelli opened a new issue #2669: Update Netty to 4.1.60.final mailing-list
cve.org
访问
[zookeeper-dev] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
cve.org
访问
[kafka-dev] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
cve.org
访问
[kafka-jira] 20210330 [jira] [Updated] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
cve.org
访问
[zookeeper-issues] 20210330 [jira] [Created] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
cve.org
访问
[kafka-jira] 20210330 [jira] [Created] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295 mailing-list
cve.org
访问
[zookeeper-issues] 20210330 [jira] [Updated] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
cve.org
访问
[zookeeper-issues] 20210402 [jira] [Commented] (ZOOKEEPER-4272) Upgrade Netty library to > 4.1.60 due to security vulnerability CVE-2021-21295 mailing-list
cve.org
访问
DSA-4885 vendor-advisory
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[activemq-users] 20210715 Next ActiveMQ Artemis Release - CVE-2021-21290 vulnerability mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
[pulsar-commits] 20211020 [GitHub] [pulsar] Shoothzj opened a new pull request #12437: [Security] Bump grpc to 1.41.0 mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
CVSS评分详情
3.1 (cna)
MEDIUM
6.2
CVSS向量: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
机密性
HIGH
完整性
NONE
可用性
NONE
时间信息
发布时间:
2021-02-08 20:10:16
修改时间:
2024-08-03 18:09:15
创建时间:
2025-11-11 15:36:37
更新时间:
2025-11-11 15:56:38
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2021-21290 2025-11-11 15:20:47 2025-11-11 07:36:37
NVD nvd_CVE-2021-21290 2025-11-11 14:57:33 2025-11-11 07:44:58
CNNVD cnnvd_CNNVD-202102-612 2025-11-11 15:10:35 2025-11-11 07:56:38
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:56:38
vulnerability_type: 未提取 → 其他; cnnvd_id: 未提取 → CNNVD-202102-612; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 其他
  • cnnvd_id: 未提取 -> CNNVD-202102-612
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:44:58
affected_products_count: 1 → 21; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 1 -> 21
  • data_sources: ['cve'] -> ['cve', 'nvd']