The vulnerability of the HttpObjectDecoder.java component of the Netty network programming framework, related to a deficiency in HTTP request interpretation, allows attackers to access confidential data and compromise its integrity.

🗓️ 20 Jan 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 11 Views

Netty HttpObjectDecoder vulnerability in Http request parsing allows data access and integrity risk.

Reporter	Title	Published	Views	Family All 147
IBM Security Bulletins	Security Bulletin: Rational Integration Tester HTTP/TCP Proxy component in Rational Test Virtualization Server and Rational Test Workbench affected by Netty vulnerabilities (CVE-2020-7238, CVE-2019-16869, CVE-2019-20445, CVE-2019-20444)	5 Mar 202011:02	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Netty affect watsonx.data	3 Sep 202420:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Netty affect watsonx.data	25 Sep 202418:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	6 Jul 202613:46	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Netty (CVE-2019-20445, CVE-2019-20444)	27 Sep 202017:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in Netty shipped with IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library (CVE-2019-20445, CVE-2019-20444)	20 Mar 202010:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	7 Jun 202316:53	–	ibm
IBM Security Bulletins	Security Bulletin: Netty Vulnerabilites 4.0.37	3 Apr 202317:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in netty affect IBM Operations Analytics Predictive Insights (CVE-2019-20445, CVE-2019-20444)	28 Feb 202016:03	–	ibm

Vulners

Node

apache nettyRange<4.1.44

Source	Link
github	www.github.com/netty/netty/issues/9861
github	www.github.com/netty/netty/pull/9865
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-20445
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-20445
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1/
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
web	www.web.nvd.nist.gov/view/vuln/detail

21 Nov 2023 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 26.4

CVSS 39.1

EPSS0.13474

Netty framework HttpObjectDecoder Http request parsing Confidential data exposure Data integrity risk Security vulnerability