HTTP Request Smuggling in Netty
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-7238US | high7.5 | — | ||
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length hea… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2020:0497WEB
- https://access.redhat.com/errata/RHSA-2020:0567WEB
- https://access.redhat.com/errata/RHSA-2020:0601WEB
- https://access.redhat.com/errata/RHSA-2020:0605WEB
- https://access.redhat.com/errata/RHSA-2020:0606WEB
- https://access.redhat.com/errata/RHSA-2020:0804WEB
- https://access.redhat.com/errata/RHSA-2020:0805WEB
- https://access.redhat.com/errata/RHSA-2020:0806WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan