GoogleOSV:GHSA-FF2W-CQ2G-WV5FHTTP Request Smuggling in Netty
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.012 Low
EPSS
Percentile
85.2%
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
| CPE | Name | Operator | Version |
|---|---|---|---|
| io.netty:netty-handler | eq | 4.1.43.Final | |
| io.netty:netty-handler | eq | 4.1.44.Final |
References
access.redhat.com/errata/RHSA-2020:0497
access.redhat.com/errata/RHSA-2020:0567
access.redhat.com/errata/RHSA-2020:0601
access.redhat.com/errata/RHSA-2020:0605
access.redhat.com/errata/RHSA-2020:0606
access.redhat.com/errata/RHSA-2020:0804
access.redhat.com/errata/RHSA-2020:0805
access.redhat.com/errata/RHSA-2020:0806
access.redhat.com/errata/RHSA-2020:0811
github.com/jdordonezn/CVE-2020-72381/issues/1
github.com/netty/netty/issues/9861
github.com/netty/netty/pull/9865
lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7@%3Ccommits.cassandra.apache.org%3E
lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05@%3Ccommits.cassandra.apache.org%3E
lists.debian.org/debian-lts-announce/2020/02/msg00017.html
lists.debian.org/debian-lts-announce/2020/02/msg00018.html
lists.debian.org/debian-lts-announce/2020/09/msg00003.html
lists.fedoraproject.org/archives/list/[email protected]/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46
netty.io/news
nvd.nist.gov/vuln/detail/CVE-2020-7238
www.debian.org/security/2021/dsa-4885
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.012 Low
EPSS
Percentile
85.2%