Lucene search
Redhat.comRH:CVE-2019-20444HistoryJul 18, 2021 - 12:29 a.m.
CVE-2019-20444
2021-07-1800:29:58
redhat.com
access.redhat.com
53
http smuggling
httpobjectdecoder
netty
data integrity
mitigation
http/2
backend connections
haproxy
EPSS
0.012
Percentile
85.6%
A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF (carriage return, line feed) without being followed by SP (space) or HTAB (horizontal tab), result in situations where headers can be misread. Data integrity is the highest threat with this vulnerability.
Mitigation
-
Use HTTP/2 instead (clear boundaries between requests)
-
Disable reuse of backend connections eg.
http-reuse never
in HAProxy or whatever equivalent LB settings
Related
nessus
nessus
Debian DLA-2365-1 : netty-3.9 security update
2020-09-08 00:00:00
Ubuntu 18.04 LTS : Netty vulnerabilities (USN-4532-1)
2020-09-23 00:00:00
Ubuntu 16.04 LTS : Netty vulnerabilities (USN-4600-1)
2020-10-22 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-2365-1)
2020-09-05 00:00:00
Ubuntu: Security Advisory (USN-4532-1)
2020-09-23 00:00:00
Ubuntu: Security Advisory (USN-4600-1)
2020-10-23 00:00:00
debian
debian
[SECURITY] [DLA 2365-1] netty-3.9 security update
2020-09-04 18:41:04
[SECURITY] [DSA 4597-1] netty security update
2020-01-03 14:58:28
[SECURITY] [DLA 1941-1] netty security update
2019-09-30 21:18:13
ubuntu
ubuntu
Netty vulnerabilities
2020-09-22 00:00:00
Netty vulnerabilities
2020-10-22 00:00:00
Netty vulnerabilities
2020-10-27 00:00:00
osv
osv
netty-3.9 vulnerabilities
2020-09-22 16:15:05
netty-3.9 - security update
2020-09-04 00:00:00
netty-3.9 vulnerabilities
2020-10-22 18:26:07
ibm
ibm
Security Bulletin: Vulnerabilities in Netty affect watsonx.data
2024-09-03 20:05:36
debiancve
debiancve
prion
prion
Design/Logic Flaw
2020-01-29 21:15:00
Design/Logic Flaw
2019-09-26 16:15:00
Design/Logic Flaw
2020-01-27 17:15:00
f5
f5
K14752415 : Netty vulnerability CVE-2019-20444
2020-07-13 00:00:00
K75555129 : Netty vulnerabilities CVE-2019-16869 and CVE-2020-7238
2020-07-13 00:00:00
veracode
veracode
HTTP Request Smuggling
2020-01-31 06:26:41
HTTP Request Smuggling
2019-09-27 08:45:44
HTTP Request Smuggling
2020-01-31 00:35:33
nvd
nvd
github
github
HTTP Request Smuggling in Netty
2020-02-21 18:55:24
HTTP Request Smuggling in Netty
2019-10-11 18:41:23
HTTP Request Smuggling in Netty
2020-02-21 18:55:50
cve
cve
ubuntucve
ubuntucve
cvelist
cvelist
redhatcve
redhatcve
redhat
redhat
(RHSA-2020:0567) Important: Red Hat build of Eclipse Vert.x 3.8.5 security update
2020-03-03 16:07:01
(RHSA-2020:0606) Important: Red Hat JBoss Enterprise Application Platform 7.2 security update
2020-02-25 17:21:05
(RHSA-2020:0601) Important: AMQ Clients 2.6.0 Release
2020-02-25 15:01:50
fedora
fedora
[SECURITY] Fedora 33 Update: netty-4.1.51-1.fc33
2020-09-25 17:16:37
[SECURITY] Fedora 33 Update: jctools-3.1.0-1.fc33
2020-09-25 17:16:36