CVE-2020-7238

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

Published Jan 27, 2020 CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Description
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-2109-1 netty security update
Debian DLA Debian DLA DLA-2110-1 netty-3.9 security update
Debian DLA Debian DLA DLA-2364-1 netty security update
Debian DSA Debian DSA DSA-4885-1 netty security update
EUVD EUVD EUVD-2020-0303 Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Github GHSA Github GHSA GHSA-ff2w-cq2g-wv5f HTTP Request Smuggling in Netty
Ubuntu USN Ubuntu USN USN-4600-1 Netty vulnerabilities
History
Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus