CVE编号
CVE-2021-21290利用情况
暂无补丁情况
官方补丁披露时间
2021-02-09漏洞描述
Netty是Netty社区的一款非阻塞I/O客户端-服务器框架，它主要用于开发Java网络应用程序，如协议服务器和客户端等。 Netty 4.1.59之前版本存在安全漏洞，该漏洞源于当netty的多部分解码器被使用时，如果磁盘上的临时存储被启用，则本地信息可以通过本地系统临时目录进行公开。在类unix系统中，所有用户共享临时目录。因此，使用没有显式设置文件/目录权限的api写入该目录可能导致信息泄露。值得注意的是，这并不影响现代的MacOS操作系统。法”文件。createTempFile\"在类unix系统上创建一个随机文件，但默认情况下将创建这个文件，权限为\"-rw-r——r——\"。因此，如果将敏感信息写入该文件，其他本地用户就可以读取该信息。解决建议
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec
参考链接 |
|
|---|---|
| https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec | |
| https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 | |
| https://lists.apache.org/thread.html/r0053443ce19ff125981559f8c51cf66e3ab4350... | |
| https://lists.apache.org/thread.html/r02e467123d45006a1dda20a38349e9c74c3a4b5... | |
| https://lists.apache.org/thread.html/r0857b613604c696bf9743f0af047360baaded48... | |
| https://lists.apache.org/thread.html/r10308b625e49d4e9491d7e079606ca0df2f0a4d... | |
| https://lists.apache.org/thread.html/r1908a34b9cc7120e5c19968a116ddbcffea5e9d... | |
| https://lists.apache.org/thread.html/r2748097ea4b774292539cf3de6e3b267fc7a88d... | |
| https://lists.apache.org/thread.html/r2936730ef0a06e724b96539bc7eacfcd3628987... | |
| https://lists.apache.org/thread.html/r2fda4dab73097051977f2ab818f75e04fbcb15b... | |
| https://lists.apache.org/thread.html/r326ec431f06eab7cb7113a7a338e59731b8d556... | |
| https://lists.apache.org/thread.html/r4efed2c501681cb2e8d629da16e48d9eac42962... | |
| https://lists.apache.org/thread.html/r584cf871f188c406d8bd447ff4e2fd9817fca86... | |
| https://lists.apache.org/thread.html/r59bac5c09f7a4179b9e2460e8f41c278aaf3b9a... | |
| https://lists.apache.org/thread.html/r5bf303d7c04da78f276765da08559fdc62420f1... | |
| https://lists.apache.org/thread.html/r5c701840aa2845191721e39821445e1e8c59711... | |
| https://lists.apache.org/thread.html/r5e4a540089760c8ecc2c411309d74264f1dad63... | |
| https://lists.apache.org/thread.html/r5e66e286afb5506cdfe9bbf68a323e8d09614f6... | |
| https://lists.apache.org/thread.html/r71dbb66747ff537640bb91eb0b2b24edef21ac0... | |
| https://lists.apache.org/thread.html/r743149dcc8db1de473e6bff0b3ddf10140a7357... | |
| https://lists.apache.org/thread.html/r790c2926efcd062067eb18fde2486527596d727... | |
| https://lists.apache.org/thread.html/r7bb3cdc192e9a6f863d3ea05422f09fa1ae2b88... | |
| https://lists.apache.org/thread.html/r9924ef9357537722b28d04c98a189750b80694a... | |
| https://lists.apache.org/thread.html/ra0fc2b4553dd7aaf75febb61052b7f1243ac3a1... | |
| https://lists.apache.org/thread.html/ra503756ced78fdc2136bd33e87cb7553028645b... | |
| https://lists.apache.org/thread.html/rb06c1e766aa45ee422e8261a8249b5617841864... | |
| https://lists.apache.org/thread.html/rb51d6202ff1a773f96eaa694b7da4ad3f44922c... | |
| https://lists.apache.org/thread.html/rb592033a2462548d061a83ac9449c5ff6609875... | |
| https://lists.apache.org/thread.html/rc0087125cb15b4b78e44000f841cd37fefedfda... | |
| https://lists.apache.org/thread.html/rc488f80094872ad925f0c73d283d4c00d32def8... | |
| https://lists.apache.org/thread.html/rcd163e421273e8dca1c71ea298dce3dd11b41d5... | |
| https://lists.apache.org/thread.html/rdba4f78ac55f803893a1a2265181595e79e3aa0... | |
| https://lists.debian.org/debian-lts-announce/2021/02/msg00016.html | |
| https://security.netapp.com/advisory/ntap-20220210-0011/ | |
| https://www.debian.org/security/2021/dsa-4885 | |
| https://www.oracle.com//security-alerts/cpujul2021.html | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | |
| https://www.oracle.com/security-alerts/cpuoct2021.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | netty | netty | * |
Up to (excluding) 4.1.59 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | netty | * |
Up to (excluding) 1:4.1.33-1+deb10u2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | netty | * |
Up to (excluding) 4.1.48-1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | netty | * |
Up to (excluding) 1:4.1.7-2+deb9u3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | netty | * |
Up to (excluding) 4.1.48-1 |
|||||
- 攻击路径 本地
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 越权影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 数据泄露
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 N/A
还没有评论，来说两句吧...