HTTP Request Smuggling in Netty
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-7238US | high7.5 | — | ||
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length hea… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2020:0497WEB
- https://access.redhat.com/errata/RHSA-2020:0567WEB
- https://access.redhat.com/errata/RHSA-2020:0601WEB
- https://access.redhat.com/errata/RHSA-2020:0605WEB
- https://access.redhat.com/errata/RHSA-2020:0606WEB
- https://access.redhat.com/errata/RHSA-2020:0804WEB
- https://access.redhat.com/errata/RHSA-2020:0805WEB
- https://access.redhat.com/errata/RHSA-2020:0806WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan