CVE:CVE-2021-21290
CNNVD:CNNVD-202102-612
Netty是Netty社区的一款非阻塞I/O客户端-服务器框架，它主要用于开发Java网络应用程序，如协议服务器和客户端等。
Netty 4.1.59之前版本存在安全漏洞，该漏洞源于当netty的多部分解码器被使用时，如果磁盘上的临时存储被启用，则本地信息可以通过本地系统临时目录进行公开。在类unix系统中，所有用户共享临时目录。因此，使用没有显式设置文件/目录权限的api写入该目录可能导致信息泄露。值得注意的是，这并不影响现代的MacOS操作系统。法”文件。createTempFile"在类unix系统上创建一个随机文件，但默认情况下将创建这个文件，权限为"-rw-r——r——"。因此，如果将敏感信息写入该文件，其他本地用户就可以读取该信息。
solution:Upgrade netty netty to a higher version than 4.1.59,and avoid the version (,4.1.59); Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade quarkus quarkus to a higher version than 1.13.7,and avoid the version (,1.13.7]; Upgrade oracle banking_corporate_lending_process_management to a higher version than 14.2.0,14.3.0,14.5.0,and avoid the version 14.2.0,14.3.0,14.5.0; Upgrade oracle banking_credit_facilities_process_management to a higher version than 14.2.0,14.3.0,14.5.0,and avoid the version 14.2.0,14.3.0,14.5.0; Upgrade oracle banking_trade_finance_process_management to a higher version than 14.2.0,14.3.0,14.5.0,and avoid the version 14.2.0,14.3.0,14.5.0; Upgrade oracle communications_brm_-_elastic_charging_engine to a higher version than 12.0.0.3,and avoid the version 12.0.0.3; Upgrade oracle communications_design_studio to a higher version than 7.4.2,and avoid the version 7.4.2; Upgrade oracle communications_messaging_server to a higher version than 8.1,and avoid the version 8.1; Upgrade oracle nosql_database to a higher version than 20.3,and avoid the version (,20.3); Upgrade netapp active_iq_unified_manager to a higher version than -; Upgrade netapp cloud_secure_agent to a higher version than -; Upgrade netapp snapcenter to a higher version than -