{
  "cveId": "CVE-2021-21290",
  "url": "https://patchblox.com/security/cve/CVE-2021-21290",
  "summary": "CVE-2021-21290 is fixed in 2 products on 1 platform, first by RLSA-2022:5498, released July 5, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libnetty-java: Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable...",
  "description": "Netty is an open-source, asynchronous event-driven network applicationframework for rapid development of maintainable high performance protocolservers \u0026 clients. In Netty before version 4.1.59.Final there is avulnerability on Unix-like systems involving an insecure temp file. Whennetty\u0027s multipart decoders are used local information disclosure can occurvia the local system temporary directory if temporary storing uploads onthe disk is enabled. On unix-like systems, the temporary directory isshared between all user. As such, writing to this directory using APIs thatdo not explicitly set the file/directory permissions can lead toinformation disclosure. Of note, this does not impact modern MacOSOperating Systems. The method \u0022File.createTempFile\u0022 on unix-like systemscreates a random file, but, by default will create this file with thepermissions \u0022-rw-r--r--\u0022. Thus, if sensitive information is written to thisfile, other local users can read this information. This is the case innetty\u0027s \u0022AbstractDiskHttpData\u0022 is vulnerable. This has been fixed inversion 4.1.59.Final. As a workaround, one may specify your own\u0022java.io.tmpdir\u0022 when you start the JVM or use\u0022DefaultHttpDataFactory.setBaseDir(...)\u0022 to set the directory to somethingthat is only readable by the current user.",
  "published": "2021-02-08T12:15:00Z",
  "severity": "Medium",
  "epss": 0.01799,
  "epssPercentile": 0.78623,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libdb",
      "release": "rocky 8",
      "fixedVersion": "0:5.3.28-42.el8_4",
      "fix": "RLSA-2022:5498",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2022-5498",
      "released": "2022-07-05T13:55:16Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1:4.1.7-4ubuntu0.1\u002Besm2",
      "fix": "libnetty-java 1:4.1.7-4ubuntu0.1\u002Besm2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libnetty-java-1-4.1.7-4ubuntu0.1-esm2",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1:4.1.45-1ubuntu0.1~esm1",
      "fix": "libnetty-java 1:4.1.45-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libnetty-java-1-4.1.45-1ubuntu0.1-esm1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "fix": "libnetty-java 1:4.1.48-4\u002Bdeb11u1build0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libnetty-java-1-4.1.48-4-deb11u1build0.22.04.1",
      "released": "2022-12-12T23:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "4.1.48-2",
      "fix": "libnetty-java 4.1.48-2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libnetty-java-4.1.48-2",
      "released": "2026-01-16T01:42:22Z"
    },
    {
      "platform": "linux",
      "product": "libnetty-java",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "4.1.48-2",
      "fix": "libnetty-java 4.1.48-2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libnetty-java-4.1.48-2",
      "released": "2026-01-16T01:42:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}