3221 matches found
CVE-2019-17513
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...
CVE-2019-11284
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...
CVE-2019-11284
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...
Authorization
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...
CVE-2019-11284 Reactor Netty authentication leak in redirects
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...
CVE-2019-11284
Affected software: Pivotal Reactor Netty (versions prior to 0.8.11). Vulnerability: redirects pass headers, including Authorization headers. Impact: remote unauthenticated attacker may access credentials for a different server. Root cause: headers leaked via redirects. Remediation: not specified ...
GHSA-P979-4MFW-53VG HTTP Request Smuggling in Netty
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...
ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +10372 more potentially affected by CVE-2019-16869 via io.netty:netty-all (>=4.0.0.Beta1 <=4.1.41.Final)
io.netty:netty-all MAVEN version =4.0.0.Beta1, =0.25, =0.25, =0.25, =0.0.25, =0.0.25, =0.0.25, =0.0.86, =0.0.86, =0.0.86, =0.0.1, =0.0.1, =0.42.1, =0.78.8 - ai.grakn.kgms:client =1.4.3 and more Source cves: CVE-2019-16869 Source advisory: OSV:GHSA-P979-4MFW-53VG...
HTTP Request Smuggling in Netty
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...
Reactor Netty authentication leak in redirects
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to...
CVE-2019-16869
A flaw was found in Netty, where whitespace before the colon in HTTP headers is mishandled. This flaw allows an attacker to cause HTTP request smuggling. Mitigation Use HTTP/2 instead clear boundaries between requests Disable reuse of backend connections eg. http-reuse never in HAProxy or whateve...
Debian: Security Advisory (DLA-1941-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DLA-1941-1 : netty security update
Netty mishandled whitespace before the colon in HTTP headers such as a 'Transfer-Encoding : chunked' line, which lead to HTTP request smuggling. For Debian 8 'Jessie', this problem has been fixed in version 1:3.2.6.Final-2+deb8u1. We recommend that you upgrade your netty packages. NOTE: Tenable...
[SECURITY] [DLA 1941-1] netty security update
Package : netty Version : 1:3.2.6.Final-2+deb8u1 CVE ID : CVE-2019-16869 Netty mishandled whitespace before the colon in HTTP headers such as a “Transfer-Encoding : chunked” line, which lead to HTTP request smuggling. For Debian 8 "Jessie", this problem has been fixed in version...
DLA-1941-1 netty - security update
Bulletin has no description...
HTTP Request Smuggling
Netty is vulnerable to HTTP request smuggling. The attack is possible because it fails to correctly handle white spaces in HTTP header names...
CVE-2019-16869
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...
CVE-2019-16869
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers such as a "Transfer-Encoding : chunked" line, which leads to HTTP request smuggling...