[SECURITY] [DSA 4597-1] netty security update

2020-01-0314:58:28

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

Debian Security Advisory DSA-4597-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
January 03, 2020 https://www.debian.org/security/faq

Package : netty
CVE ID : CVE-2019-16869
Debian Bug : 941266

It was reported that Netty, a Java NIO client/server framework, is prone
to a HTTP request smuggling vulnerability due to mishandling whitespace
before the colon in HTTP headers.

For the oldstable distribution (stretch), this problem has been fixed
in version 1:4.1.7-2+deb9u1.

For the stable distribution (buster), this problem has been fixed in
version 1:4.1.33-1+deb10u1.

We recommend that you upgrade your netty packages.

For the detailed security status of netty please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/netty

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9allnetty-3.9< 3.9.9.Final-1+deb9u1netty-3.9_3.9.9.Final-1+deb9u1_all.deb
Debian9alllibnetty-3.9-java< 3.9.9.Final-1+deb9u1libnetty-3.9-java_3.9.9.Final-1+deb9u1_all.deb
Debian10alllibnetty-java< 4.1.33-1+deb10u1libnetty-java_4.1.33-1+deb10u1_all.deb
Debian8alllibnetty-3.9-java< 3.9.0.Final-1+deb8u1libnetty-3.9-java_3.9.0.Final-1+deb8u1_all.deb
Debian8allnetty-3.9< 3.9.0.Final-1+deb8u1netty-3.9_3.9.0.Final-1+deb8u1_all.deb
Debian9alllibnetty-java< 4.1.7-2+deb9u1libnetty-java_4.1.7-2+deb9u1_all.deb
Debian9allnetty< 1:4.1.7-2+deb9u1netty_1:4.1.7-2+deb9u1_all.deb
Debian8allnetty< 1:3.2.6.Final-2+deb8u1netty_1:3.2.6.Final-2+deb8u1_all.deb
Debian8alllibnetty-java< 3.2.6.Final-2+deb8u1libnetty-java_3.2.6.Final-2+deb8u1_all.deb
Debian10allnetty< 1:4.1.33-1+deb10u1netty_1:4.1.33-1+deb10u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	all	netty-3.9	< 3.9.9.Final-1+deb9u1	netty-3.9_3.9.9.Final-1+deb9u1_all.deb
Debian	9	all	libnetty-3.9-java	< 3.9.9.Final-1+deb9u1	libnetty-3.9-java_3.9.9.Final-1+deb9u1_all.deb
Debian	10	all	libnetty-java	< 4.1.33-1+deb10u1	libnetty-java_4.1.33-1+deb10u1_all.deb
Debian	8	all	libnetty-3.9-java	< 3.9.0.Final-1+deb8u1	libnetty-3.9-java_3.9.0.Final-1+deb8u1_all.deb
Debian	8	all	netty-3.9	< 3.9.0.Final-1+deb8u1	netty-3.9_3.9.0.Final-1+deb8u1_all.deb
Debian	9	all	libnetty-java	< 4.1.7-2+deb9u1	libnetty-java_4.1.7-2+deb9u1_all.deb
Debian	9	all	netty	< 1:4.1.7-2+deb9u1	netty_1:4.1.7-2+deb9u1_all.deb
Debian	8	all	netty	< 1:3.2.6.Final-2+deb8u1	netty_1:3.2.6.Final-2+deb8u1_all.deb
Debian	8	all	libnetty-java	< 3.2.6.Final-2+deb8u1	libnetty-java_3.2.6.Final-2+deb8u1_all.deb
Debian	10	all	netty	< 1:4.1.33-1+deb10u1	netty_1:4.1.33-1+deb10u1_all.deb