{
  "threat_severity" : "Moderate",
  "public_date" : "2021-03-09T00:00:00Z",
  "bugzilla" : {
    "description" : "netty: possible request smuggling in HTTP/2 due missing validation",
    "id" : "1937364",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1937364"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-444",
  "details" : [ "Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.", "In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling." ],
  "statement" : "Red Hat OpenStack Platform's OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.",
  "affected_release" : [ {
    "product_name" : "AMQ Clients 2.y for RHEL 7",
    "release_date" : "2021-05-06T00:00:00Z",
    "advisory" : "RHSA-2021:1511",
    "cpe" : "cpe:/a:redhat:a_mq_clients:2::el7",
    "package" : "qpid-proton-0:0.33.0-6.el7_9"
  }, {
    "product_name" : "AMQ Clients 2.y for RHEL 8",
    "release_date" : "2021-05-06T00:00:00Z",
    "advisory" : "RHSA-2021:1511",
    "cpe" : "cpe:/a:redhat:a_mq_clients:2::el8",
    "package" : "qpid-proton-0:0.33.0-8.el8"
  }, {
    "product_name" : "Red Hat AMQ 7.8.2",
    "release_date" : "2021-07-12T00:00:00Z",
    "advisory" : "RHSA-2021:2689",
    "cpe" : "cpe:/a:redhat:amq_broker:7",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat AMQ 7.9.0",
    "release_date" : "2021-09-30T00:00:00Z",
    "advisory" : "RHSA-2021:3700",
    "cpe" : "cpe:/a:redhat:amq_broker:7"
  }, {
    "product_name" : "Red Hat AMQ Online 1.7.0 GA",
    "release_date" : "2021-03-25T00:00:00Z",
    "advisory" : "RHSA-2021:0986",
    "cpe" : "cpe:/a:redhat:amq_online:1.7",
    "package" : "netty",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat AMQ Streams 1.8.0",
    "release_date" : "2021-08-19T00:00:00Z",
    "advisory" : "RHSA-2021:3225",
    "cpe" : "cpe:/a:redhat:amq_streams:1",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat build of Eclipse Vert.x 4.0.3",
    "release_date" : "2021-03-31T00:00:00Z",
    "advisory" : "RHSA-2021:0943",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat build of Quarkus 2.2.3",
    "release_date" : "2021-10-20T00:00:00Z",
    "advisory" : "RHSA-2021:3880",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat Data Grid 8.2.0",
    "release_date" : "2021-05-26T00:00:00Z",
    "advisory" : "RHSA-2021:2139",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:8",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat EAP-XP 2.0.0 via EAP 7.3.x base",
    "release_date" : "2021-07-15T00:00:00Z",
    "advisory" : "RHSA-2021:2755",
    "cpe" : "cpe:/a:redhat:jbosseapxp",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat Fuse 7.10",
    "release_date" : "2021-12-14T00:00:00Z",
    "advisory" : "RHSA-2021:5134",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2051",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3",
    "package" : "netty"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-artemis-wildfly-integration-0:1.0.4-1.redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-bouncycastle-0:1.68.0-2.redhat_00005.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-hal-console-0:3.2.14-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-infinispan-0:9.4.22-3.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-ironjacamar-0:1.4.30-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-genericjms-0:2.0.9-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-marshalling-0:2.0.11-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-server-migration-0:1.7.2-6.Final_redhat_00007.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jboss-weld-3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-jgroups-kubernetes-0:1.0.16-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-netty-0:4.1.60-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-resteasy-0:3.11.4-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-undertow-0:2.0.35-1.SP1_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-velocity-0:2.3.0-1.redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-weld-core-0:3.1.6-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-wildfly-0:7.3.7-1.GA_redhat_00002.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-wildfly-elytron-0:1.10.12-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-wildfly-http-client-0:1.0.26-1.Final_redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-xalan-j2-0:2.7.1-36.redhat_00013.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2046",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el6",
    "package" : "eap7-yasson-0:1.0.9-1.redhat_00001.1.el6eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-artemis-wildfly-integration-0:1.0.4-1.redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-bouncycastle-0:1.68.0-2.redhat_00005.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-hal-console-0:3.2.14-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-infinispan-0:9.4.22-3.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-ironjacamar-0:1.4.30-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-genericjms-0:2.0.9-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-marshalling-0:2.0.11-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-server-migration-0:1.7.2-6.Final_redhat_00007.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jboss-weld-3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-jgroups-kubernetes-0:1.0.16-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-netty-0:4.1.60-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-resteasy-0:3.11.4-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-undertow-0:2.0.35-1.SP1_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-velocity-0:2.3.0-1.redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-weld-core-0:3.1.6-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-wildfly-0:7.3.7-1.GA_redhat_00002.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-wildfly-elytron-0:1.10.12-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-wildfly-http-client-0:1.0.26-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-xalan-j2-0:2.7.1-36.redhat_00013.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2047",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el7",
    "package" : "eap7-yasson-0:1.0.9-1.redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-artemis-wildfly-integration-0:1.0.4-1.redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-bouncycastle-0:1.68.0-2.redhat_00005.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-hal-console-0:3.2.14-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-infinispan-0:9.4.22-3.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-ironjacamar-0:1.4.30-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-genericjms-0:2.0.9-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-marshalling-0:2.0.11-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-server-migration-0:1.7.2-6.Final_redhat_00007.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jboss-weld-3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-jgroups-kubernetes-0:1.0.16-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-mod_cluster-0:1.4.3-2.Final_redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-netty-0:4.1.60-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-resteasy-0:3.11.4-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-undertow-0:2.0.35-1.SP1_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-velocity-0:2.3.0-1.redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-weld-core-0:3.1.6-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-wildfly-0:7.3.7-1.GA_redhat_00002.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-wildfly-elytron-0:1.10.12-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-wildfly-http-client-0:1.0.26-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-xalan-j2-0:2.7.1-36.redhat_00013.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8",
    "release_date" : "2021-05-19T00:00:00Z",
    "advisory" : "RHSA-2021:2048",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.3::el8",
    "package" : "eap7-yasson-0:1.0.9-1.redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "release_date" : "2021-09-23T00:00:00Z",
    "advisory" : "RHSA-2021:3658",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
    "package" : "eap7-netty-0:4.1.63-1.Final_redhat_00001.1.el8eap"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "release_date" : "2021-09-23T00:00:00Z",
    "advisory" : "RHSA-2021:3656",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
    "package" : "eap7-netty-0:4.1.63-1.Final_redhat_00001.1.el7eap"
  }, {
    "product_name" : "Red Hat Satellite 6.11 for RHEL 7",
    "release_date" : "2022-07-05T00:00:00Z",
    "advisory" : "RHSA-2022:5498",
    "cpe" : "cpe:/a:redhat:satellite:6.11::el7",
    "package" : "candlepin-0:4.1.13-1.el7sat"
  }, {
    "product_name" : "Red Hat Satellite 6.11 for RHEL 8",
    "release_date" : "2022-07-05T00:00:00Z",
    "advisory" : "RHSA-2022:5498",
    "cpe" : "cpe:/a:redhat:satellite:6.11::el8",
    "package" : "candlepin-0:4.1.13-1.el8sat"
  }, {
    "product_name" : "Red Hat Single Sign-On 7.4.7",
    "release_date" : "2021-05-20T00:00:00Z",
    "advisory" : "RHSA-2021:2070",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7",
    "package" : "netty"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat build of Quarkus",
    "fix_state" : "Affected",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  }, {
    "product_name" : "Red Hat Decision Manager 7",
    "fix_state" : "Not affected",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_brms_platform:7"
  }, {
    "product_name" : "Red Hat JBoss A-MQ 6",
    "fix_state" : "Out of support scope",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_amq:6"
  }, {
    "product_name" : "Red Hat JBoss Data Grid 7",
    "fix_state" : "Out of support scope",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 5",
    "fix_state" : "Out of support scope",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:5"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 6",
    "fix_state" : "Out of support scope",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:6"
  }, {
    "product_name" : "Red Hat JBoss Fuse 6",
    "fix_state" : "Out of support scope",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_fuse:6"
  }, {
    "product_name" : "Red Hat JBoss Operations Network 3",
    "fix_state" : "Out of support scope",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_operations_network:3"
  }, {
    "product_name" : "Red Hat OpenShift Application Runtimes",
    "fix_state" : "Will not fix",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:openshift_application_runtimes:1.0"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "openshift3/ose-logging-elasticsearch5",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Out of support scope",
    "package_name" : "openshift4/ose-logging-elasticsearch5",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Out of support scope",
    "package_name" : "openshift4/ose-logging-elasticsearch6",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-metering-hadoop",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-metering-hive",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-metering-presto",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenStack Platform 10 (Newton)",
    "fix_state" : "Out of support scope",
    "package_name" : "opendaylight",
    "cpe" : "cpe:/a:redhat:openstack:10"
  }, {
    "product_name" : "Red Hat OpenStack Platform 13 (Queens)",
    "fix_state" : "Will not fix",
    "package_name" : "opendaylight",
    "cpe" : "cpe:/a:redhat:openstack:13"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Not affected",
    "package_name" : "netty",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-21295\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-21295\nhttps://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj" ],
  "name" : "CVE-2021-21295",
  "csaw" : false
}