Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

A flaw was found in Netty, where it mishandles Transfer-Encoding whitespace. This flaw allows HTTP Request Smuggling...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

A flaw was found in Netty before version 4.1.44, where it accepted multiple Content-Length headers and also accepted both Transfer-Encoding, as well as Content-Length headers where it should reject the message under such circumstances. In circumstances where Netty is used in the context of a...

Important: Red Hat Security Advisory: AMQ Clients 2.6.0 Release

An update is now available for Red Hat AMQ Clients 2.6.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links ...

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

A flaw was found in Netty, where it mishandles Transfer-Encoding whitespace. This flaw allows HTTP Request Smuggling...

netty: HTTP request smuggling

A HTTP smuggling flaw was found in HttpObjectDecoder.java in Netty in versions prior to version 4.1.44. HTTP headers with an invalid fold, in this case CRLF carriage return, line feed without being followed by SP space or HTAB horizontal tab, result in situations where headers can be misread. Dat...

PT-2020-6587

Name of the Vulnerable Software and Affected Versions io.netty:netty-codec-http2 versions prior to 4.1.61.Final Description The issue is related to a lack of proper validation of the content-length header in HTTP/2 requests. If a request only uses a single Http2HeaderFrame with the endStream set ...

GHSA-FF2W-CQ2G-WV5F HTTP Request Smuggling in Netty

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace such as a spaceTransfer-Encoding:chunked line and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869...

HTTP Request Smuggling in Netty

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace such as a spaceTransfer-Encoding:chunked line and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869...

com.twitter:ostrich (2.3.0), com.twitter:ostrich_2.8.0 (>=2.2.6, <=2.2.10) +8 more potentially affected by CVE-2019-20444 via org.jboss.netty:netty (3.1.5.ga)

org.jboss.netty:netty MAVEN version 3.1.5.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.netty:netty and may be impacted: - com.twitter:ostrich 2.3.0 - com.twitter:ostrich2.8.0 =2.2.6, =2.2.11, =1.3.0, =1.3.2, =1.3.4 Source cves:...

com.kolibrifx.mq:mq-provider-lettuce (1.0.0), com.lambdaworks:lettuce (2.1.0) potentially affected by CVE-2019-20444 via io.netty:netty (3.4.0.beta1)

io.netty:netty MAVEN version 3.4.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.kolibrifx.mq:mq-provider-lettuce 1.0.0 - com.lambdaworks:lettuce 2.1.0 Source cves: CVE-2019-20444 Source advisory:...

org.codehaus.fabric3:fabric3-binding-net (>=1.1, <=1.7), org.codehaus.fabric3:profile-net (>=1.1, <=1.7) potentially affected by CVE-2019-20444 via org.jboss.netty:netty (3.1.0.beta1)

org.jboss.netty:netty MAVEN version 3.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.netty:netty and may be impacted: - org.codehaus.fabric3:fabric3-binding-net =1.1, =1.1, =1.7 Source cves: CVE-2019-20444 Source advisory:...

com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-duplex (>=1.2.2, <=1.2.3), com.googlecode.protobuf-rpc-pro:protobuf-streamer-pro (>=1.2.2, <=1.2.3) +39 more potentially affected by CVE-2019-20444 via io.netty:netty (3.4.6.final)

io.netty:netty MAVEN version 3.4.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.googlecode.protobuf-rpc-pro:protobuf-rpc-pro-duplex =1.2.2, =1.2.2, =1.2.3 - net.databinder:unfiltered-netty-server2.8.1...

org.apache.nifi:nifi-hbase_1_1_2-client-service (>=1.9.0, <=1.14.0), org.apache.nifi:nifi-hbase_1_1_2-client-service-nar (>=1.9.0, <=1.14.0) +11 more potentially affected by CVE-2019-20444 via io.netty:netty (3.6.9.final)

io.netty:netty MAVEN version 3.6.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - org.apache.nifi:nifi-hbase112-client-service =1.9.0, =1.9.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =2.3.22.final, =2.3.22.final,...

co.cask.cdap:cdap-api-spark (>=3.4.0, <=5.1.2), co.cask.cdap:cdap-api-spark2_2.11 (>=4.2.0, <=5.1.2) +250 more potentially affected by CVE-2019-20444 via org.jboss.netty:netty (3.2.7.final)

org.jboss.netty:netty MAVEN version 3.2.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.netty:netty and may be impacted: - co.cask.cdap:cdap-api-spark =3.4.0, =4.2.0, =3.4.0, =4.2.0, =3.5.0, =4.2.0, =3.4.0, =4.2.0, =3.5.0, =4.2.0,...