CVE-2021-21290

一、漏洞信息
 漏洞编号：[CVE-2021-21290](https://nvd.nist.gov/vuln/detail/CVE-2021-21290)
 漏洞归属组件：[netty](https://gitee.com/src-openeuler/netty)
 漏洞归属的版本：4.1.13
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
 漏洞简述：
  Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty s multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method  File.createTempFile  on unix-like systems creates a random file, but, by default will create this file with the permissions  -rw-r--r-- . Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty s  AbstractDiskHttpData  is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own  java.io.tmpdir  when you start the JVM or use  DefaultHttpDataFactory.setBaseDir(...)  to set the directory to something that is only readable by the current user.
 漏洞公开时间：2021-02-09 04:15
 漏洞创建时间：2021-02-20 19:52:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-21290
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| CONFIRM | https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 |  |
| MISC | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  |
| MLIST | https://lists.debian.org/debian-lts-announce/2021/02/msg00016.html |  |
| MLIST | https://lists.apache.org/thread.html/rc488f80094872ad925f0c73d283d4c00d32def81977438e27a3dc2bb@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r2748097ea4b774292539cf3de6e3b267fc7a88d6c8ec40f4e2e87bd4@%3Cdev.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r10308b625e49d4e9491d7e079606ca0df2f0a4d828f1ad1da64ba47b@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/ra503756ced78fdc2136bd33e87cb7553028645b261b1f5c6186a121e@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r0857b613604c696bf9743f0af047360baaded48b1c75cf6945a083c5@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r71dbb66747ff537640bb91eb0b2b24edef21ac07728097016f58b01f@%3Ccommits.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/rdba4f78ac55f803893a1a2265181595e79e3aa027e2e651dfba98c18@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/ra0fc2b4553dd7aaf75febb61052b7f1243ac3a180a71c01f29093013@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r326ec431f06eab7cb7113a7a338e59731b8d556d05258457f12bac1b@%3Cdev.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r5e4a540089760c8ecc2c411309d74264f1dad634ad93ad583ca16214@%3Ccommits.kafka.apache.org%3E |  |
| MISC | https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350f47812b8cf0733a05@%3Cdev.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r743149dcc8db1de473e6bff0b3ddf10140a7357bc2add75f7d1fbb12@%3Cdev.zookeeper.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r5bf303d7c04da78f276765da08559fdc62420f1df539b277ca31f63b@%3Cissues.zookeeper.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r4efed2c501681cb2e8d629da16e48d9eac429624fd4c9a8c6b8e7020@%3Cdev.tinkerpop.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f@%3Cdev.ranger.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5@%3Cdev.ranger.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d@%3Ccommits.pulsar.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48@%3Ccommits.pulsar.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325@%3Ccommits.pulsar.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890@%3Cissues.bookkeeper.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6d1ddc806ed0224700@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda942fd7ddf3ad1b528@%3Cissues.zookeeper.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff66098751748fcd1e2d008233@%3Cissues.zookeeper.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a21cc23678eb893e41@%3Cjira.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904@%3Cdev.zookeeper.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b561784186483e8f742ea627bda4@%3Cdev.kafka.apache.org%3E |  |
| MLIST | https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987c16b1b99c790e7b87@%3Cissues.zookeeper.apache.org%3E |  |
| DEBIAN | https://www.debian.org/security/2021/dsa-4885 |  |
| MISC | https://www.oracle.com/security-alerts/cpuApr2021.html |  |
| MLIST | https://lists.apache.org/thread.html/r5c701840aa2845191721e39821445e1e8c59711e71942b7796a6ec29@%3Cusers.activemq.apache.org%3E |  |
| N/A | https://www.oracle.com//security-alerts/cpujul2021.html |  |
| MISC | https://www.oracle.com/security-alerts/cpuoct2021.html |  |
| MLIST | https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071@%3Ccommits.pulsar.apache.org%3E |  |
| CONFIRM | https://security.netapp.com/advisory/ntap-20220210-0011/ |  |
| MISC | https://www.oracle.com/security-alerts/cpuapr2022.html |  |
| redhat | https://access.redhat.com/security/cve/CVE-2021-21290 |  |
| suse_bugzilla | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  |
| suse_bugzilla | https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 |  |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=1927028 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21290 |  |
| suse_bugzilla | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21290 |  |
| redhat_bugzilla | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21290 |  |
| ubuntu | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  |
| ubuntu | https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 |  |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-21290 |  |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-21290 |  |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-21290 |  |
| debian | https://security-tracker.debian.org/tracker/CVE-2021-21290 |  |
| oracle | https://www.oracle.com/security-alerts/cpujul2021.html |  |
| MISC | https://www.oracle.com/security-alerts/cpuapr2022.html |  |
| github | https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 |  |
| github |  https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  |
| lists |  https://lists.debian.org/debian-lts-announce/2021/02/msg00016.html |  |
| lists |  https://lists.apache.org/thread.html/rc488f80094872ad925f0c73d283d4c00d32def81977438e27a3dc2bb@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r2748097ea4b774292539cf3de6e3b267fc7a88d6c8ec40f4e2e87bd4@%3Cdev.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r10308b625e49d4e9491d7e079606ca0df2f0a4d828f1ad1da64ba47b@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/ra503756ced78fdc2136bd33e87cb7553028645b261b1f5c6186a121e@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r0857b613604c696bf9743f0af047360baaded48b1c75cf6945a083c5@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r71dbb66747ff537640bb91eb0b2b24edef21ac07728097016f58b01f@%3Ccommits.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/rdba4f78ac55f803893a1a2265181595e79e3aa027e2e651dfba98c18@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/ra0fc2b4553dd7aaf75febb61052b7f1243ac3a180a71c01f29093013@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r326ec431f06eab7cb7113a7a338e59731b8d556d05258457f12bac1b@%3Cdev.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r5e4a540089760c8ecc2c411309d74264f1dad634ad93ad583ca16214@%3Ccommits.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350f47812b8cf0733a05@%3Cdev.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r743149dcc8db1de473e6bff0b3ddf10140a7357bc2add75f7d1fbb12@%3Cdev.zookeeper.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r5bf303d7c04da78f276765da08559fdc62420f1df539b277ca31f63b@%3Cissues.zookeeper.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r4efed2c501681cb2e8d629da16e48d9eac429624fd4c9a8c6b8e7020@%3Cdev.tinkerpop.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b53e2e07be0939ecb3f@%3Cdev.ranger.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88d4663e63696ee7ef5@%3Cdev.ranger.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d51c3a812e0394e6a5d@%3Ccommits.pulsar.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a19754e5057c34ca48@%3Ccommits.pulsar.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c40b3d4e1a19c2f325@%3Ccommits.pulsar.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d7275381cfaff2f7b3890@%3Cissues.bookkeeper.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6d1ddc806ed0224700@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda942fd7ddf3ad1b528@%3Cissues.zookeeper.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff66098751748fcd1e2d008233@%3Cissues.zookeeper.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a21cc23678eb893e41@%3Cjira.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9deb76c2be4fa461904@%3Cdev.zookeeper.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b561784186483e8f742ea627bda4@%3Cdev.kafka.apache.org%3E |  |
| lists |  https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987c16b1b99c790e7b87@%3Cissues.zookeeper.apache.org%3E |  |
| debian |  https://www.debian.org/security/2021/dsa-4885 |  |
| oracle |  https://www.oracle.com/security-alerts/cpuApr2021.html |  |
| lists |  https://lists.apache.org/thread.html/r5c701840aa2845191721e39821445e1e8c59711e71942b7796a6ec29@%3Cusers.activemq.apache.org%3E |  |
| oracle |  https://www.oracle.com//security-alerts/cpujul2021.html |  |
| oracle |  https://www.oracle.com/security-alerts/cpuoct2021.html |  |
| lists |  https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca862436c064d0951a071@%3Ccommits.pulsar.apache.org%3E |  |
| security |  https://security.netapp.com/advisory/ntap-20220210-0011/ |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  | MISC |
|  |  | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  | suse_bugzilla |
|  |  | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  | redhat_bugzilla |
|  |  | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  | ubuntu |
|  |  | https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec |  | nvd |
|  |  | https://lists.apache.org/thread.html/rc488f80094872ad925f0c73d283d4c00d32def81977438e27a3dc2bb@%3Cjira.kafka.apache.org%3E |  | nvd |
|  |  | https://lists.apache.org/thread.html/r2748097ea4b774292539cf3de6e3b267fc7a88d6c8ec40f4e2e87bd4@%3Cdev.kafka.apache.org%3E |  | nvd |
|  |  | https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15bb1003c8530eac1059@%3Cjira.kafka.apache.org%3E |  | nvd |
|  |  | https://www.oracle.com/security-alerts/cpuApr2021.html |  | nvd |
|  |  | https://www.oracle.com/security-alerts/cpuoct2021.html |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    Netty是一个开源的，异步事件驱动的网络应用程序框架，用于快速开发可维护的高性能协议服务器和客户端。在Netty 4.1.59.Final之前的版本中，在类Unix系统上存在一个涉及不安全临时文件的漏洞。使用netty的多部分解码器时，如果启用了磁盘上的临时存储上载功能，则可以通过本地系统临时目录进行本地信息公开。在类似Unix的系统上，临时目录在所有用户之间共享。因此，使用未明确设置文件/目录许可权的API写入此目录可能会导致信息泄露。值得注意的是，这不会影响现代MacOS操作系统。类似Unix的系统上的方法“ File.createTempFile”会创建一个随机文件，但是，默认情况下，将使用权限“ -rw-r--r--”创建此文件。因此，如果将敏感信息写入此文件，则其他本地用户可以读取此信息。这是netty的“ AbstractDiskHttpData”容易受到攻击的情况。此问题已在4.1.59.Final版本中修复。作为一种解决方法，您可以在启动JVM时指定自己的“ java.io.tmpdir”，或使用“ DefaultHttpDataFactory.setBaseDir（...）”将目录设置为当前用户只能读取的目录。 
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(4.1.13):受影响
2.openEuler-20.03-LTS-Next(4.1.13):受影响
3.openEuler-20.03-LTS-SP1(4.1.13):受影响
4.openEuler-20.09(4.1.13):受影响
5.openEuler-21.03(4.1.13):受影响
6.openEuler-20.03-LTS:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.1.13):
2.openEuler-20.03-LTS-SP3(4.1.13):
3.openEuler-22.03-LTS(4.1.13):
4.openEuler-22.03-LTS-SP1(4.1.13):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2021-1143

src-openEuler/netty

内容风险标识

评论 (6)

src-openEuler/netty .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-21290

评论 (6)

搜索帮助

src-openEuler/netty