Skip to content
Fencer Vulns
medium 6.2

CVE-2021-21290 json

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

published 2021-02-08 5 y ago modified 2026-10-08 31 d ago also GHSA-5mcr-gq6c-3hq2 , EUVD-2021-0535

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

Patch / fix

  • maven io.netty:netty-codec-http 4.1.59.Final
  • netty netty 4.1.59
  • oracle nosql_database 20.3
  • netty Debian 14, Debian 13, Debian 12 1:4.1.48-2

debian advisories DEBIAN-CVE-2021-21290

  • netty Ubuntu 22.04 LTS 1:4.1.48-4+deb11u1build0.22.04.1
  • netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm1
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm2
  • netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-21290

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el7sat
  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el8sat
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el7pc
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el8pc
  • candlepin satellite 6.11 4.1.13-1.el7sat
  • candlepin satellite 6.11 4.1.13-1.el8sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el7sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el8sat

red hat advisories RHSA-2022:5498RHSA-2021:2047RHSA-2021:2046RHSA-2021:2048RHSA-2022:0190RHSA-2021:1511

  • netty Manager Server Module 4.1 4.1.44.Final-150200.3.4.2
  • netty Manager Server Module 4.3 4.1.44.Final-150400.3.3.2
  • netty Manager Server Module 4.2 4.1.44.Final-150300.4.3.2
  • netty openSUSE Leap 15.3 4.1.75-150200.4.6.2

suse advisories SUSE-SU-2022:3793-1SUSE-SU-2022:3760-1SUSE-SU-2022:3617-1SUSE-SU-2022:1271-1

  • netty openSUSE Tumbleweed 4.1.60-1.4

opensuse advisories openSUSE-SU-2024:11085-1

  • libdb Rocky Linux 8 5.3.28-42.el8_4

rocky linux advisories RLSA-2022:5498

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-21290 updated cvss 6.2

netty: Information disclosure via the local system temporary directory

  • Red Hat JBoss A-MQ 6 netty netty Red Hat JBoss Data Grid 7 netty netty Red Hat JBoss Enterprise Application Platform 5 netty netty Red Hat JBoss Enterprise Application Platform 6 netty netty
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack netty netty
    affected: no fix available
  • Red Hat JBoss Fuse 6 netty netty Red Hat JBoss Operations Network 3 netty netty
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes netty netty Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5, openshift4/ose-logging-elasticsearch6
    affected: no fix planned “Out of support scope”
  • Red Hat AMQ 7.8.2
    fixed: vendor fix RHSA-2021:2689
  • Red Hat AMQ 7.9.0
    fixed: vendor fix RHSA-2021:3700
  • Red Hat AMQ Clients 2 qpid-proton 0.33.0-8.el8, qpid-proton 0.33.0-6.el7_9, qpid-proton-c 0.33.0-8.el8, qpid-proton-c 0.33.0-6.el7_9, qpid-proton-cpp 0.33.0-8.el8, qpid-proton-cpp 0.33.0-6.el7_9, +6 more
    fixed: vendor fix RHSA-2021:1511
show 19 more
  • Red Hat AMQ Online 1.7.0 GA
    fixed: vendor fix RHSA-2021:0986
  • Red Hat AMQ Streams 1.8.0
    fixed: vendor fix RHSA-2021:3225
  • Red Hat build of Eclipse Vert.x 4.0.3
    fixed: vendor fix RHSA-2021:0943
  • Red Hat build of Quarkus 2.2.3
    fixed: vendor fix RHSA-2021:3880
  • Red Hat Data Grid 8.2.0
    fixed: vendor fix RHSA-2021:2139
  • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:2755
  • Red Hat EAP-XP via EAP 7.3.x base
    fixed: vendor fix RHSA-2021:2210
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-yasson 1.0.9-1.redhat_00001.1.el8eap, eap7-velocity 2.3.0-1.redhat_00001.1.el8eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el8eap, eap7-wildfly 7.3.7-1.GA_redhat_00002.1.el8eap, eap7-netty 4.1.60-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle 1.68.0-2.redhat_00005.1.el8eap, +92 more
    fixed: vendor fix RHSA-2021:2048
  • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-yasson 1.0.9-1.redhat_00001.1.el6eap, eap7-velocity 2.3.0-1.redhat_00001.1.el6eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el6eap, eap7-wildfly 7.3.7-1.GA_redhat_00002.1.el6eap, eap7-netty 4.1.60-1.Final_redhat_00001.1.el6eap, eap7-bouncycastle 1.68.0-2.redhat_00005.1.el6eap, +92 more
    fixed: vendor fix RHSA-2021:2046
  • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-yasson 1.0.9-1.redhat_00001.1.el7eap, eap7-velocity 2.3.0-1.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-36.redhat_00013.1.el7eap, eap7-wildfly 7.3.7-1.GA_redhat_00002.1.el7eap, eap7-netty 4.1.60-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle 1.68.0-2.redhat_00005.1.el7eap, +94 more
    fixed: vendor fix RHSA-2021:2047
  • Red Hat JBoss Enterprise Application Platform 7
    fixed: vendor fix RHSA-2021:2051
  • Red Hat Satellite 6.10 satellite 6.10.2-1.el7sat, satellite-cli 6.10.2-1.el7sat, satellite-common 6.10.2-1.el7sat
    fixed: vendor fix RHSA-2022:0190
  • Red Hat Satellite 6.11 for RHEL 7 candlepin 4.1.13-1.el7sat Red Hat Satellite 6.11 for RHEL 8 candlepin 4.1.13-1.el8sat
    fixed: vendor fix RHSA-2022:5498
  • Red Hat Satellite Capsule 6.10 satellite 6.10.2-1.el7sat, satellite-common 6.10.2-1.el7sat, satellite-capsule 6.10.2-1.el7sat
    fixed: vendor fix RHSA-2022:0190
  • Red Hat Single Sign-On 7.4.7
    fixed: vendor fix RHSA-2021:2070
  • Red Hat RHDM 7.12.1
    fixed: vendor fix RHSA-2022:1110
  • Red Hat RHPAM 7.12.1
    fixed: vendor fix RHSA-2022:1108
  • Red Hat Satellite 6.10 pulpcore-selinux 1.2.7-1.el7pc, tfm-rubygem-katello 4.1.1.42-1.el7sat Red Hat Satellite 6.11 for RHEL 7 tfm 7.0-1.el7sat, gofer 2.12.5-7.el7sat, katello 4.3.0-3.el7sat, libsolv 0.7.22-1.el7pc, libcomps 0.1.18-1.el7pc, libsolv0 0.6.34-4.el7sat, +637 more Red Hat Satellite 6.11 for RHEL 8 libdb 5.3.28-42.el8_4, katello 4.3.0-3.el8sat, libsolv 0.7.22-1.el8pc, libcomps 0.1.18-1.el8pc, python-idna 3.3-1.el8pc, python-pbr 5.6.0-1.el8pc, +628 more Red Hat Satellite Capsule 6.10 pulpcore-selinux 1.2.7-1.el7pc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
31 d ago

Exploit prediction

1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-codec-http
>=4.0.0, <4.1.59.Final
4.1.59.Final
maven org.jboss.netty:netty
all versions
 no fix listed
maven io.netty:netty
all versions
 no fix listed

Affected products

  • netty netty

Classification

Weakness
  • CWE-378 Creation of Temporary File With Insecure Permissions
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.