CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 1CVE-2019-16869 – netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers
https://notcve.org/view.php?id=CVE-2019-16869
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Netty versiones anteriores a 4.1.42.Final, maneja inapropiadamente los espacios en blanco antes de los dos puntos en los encabezados HTTP (tal y como una línea "Transfer-Encoding : chunked"), lo que conlleva al tráfico no autorizado de peticiones HTTP. A flaw was found in Netty, where whitespace before the colon in HTTP headers is mishandled. This flaw allows an attacker to cause HTTP request smuggling. • https://access.redhat.com/errata/RHSA-2019:3892 https://access.redhat.com/errata/RHSA-2019:3901 https://access.redhat.com/errata/RHSA-2020:0159 https://access.redhat.com/errata/RHSA-2020:0160 https://access.redhat.com/errata/RHSA-2020:0161 https://access.redhat.com/errata/RHSA-2020:0164 https://access.redhat.com/errata/RHSA-2020:0445 https://github.com/netty/netty/compare/netty-4.1.41.Final...netty-4.1.42.Final https://github.com/netty/netty/issues/9571 https& • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.5EPSS: 0%CPEs: 110EXPL: 0CVE-2015-2156
https://notcve.org/view.php?id=CVE-2015-2156
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. Netty en versiones anteriores a la 3.9.8.Final, 3.10.x anteriores a la 3.10.3.Final, 4.0.x anteriores a la 4.0.28.Final y 4.1.x anteriores a la 4.1.0.Beta5 y Play Framework 2.x en versiones anteriores a la 2.3.9 podría permitir que atacantes remotos omitan el indicador httpOnly en las cookies y obtengan información sensible aprovechando la validación incorrecta del nombre de la cookie y los caracteres del valor. • http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html http://www.openwall.com/lists/oss-security/2015/05/17/1 http://www.securityfocus.com/bid/74704 https://bugzilla.redhat.com/show_bug.cgi?id=1222923 https://github.com/netty/netty/pull/3754 https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 1%CPEs: 5EXPL: 0CVE-2016-4970 – netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl
https://notcve.org/view.php?id=CVE-2016-4970
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop). handler/ssl/OpenSslEngine.java en Netty 4.0.x en versiones anteriores a 4.0.37.Final y 4.1.x en versiones anteriores a 4.1.1.Final permite a los atacantes remotos provocar una denegación de servicio (bucle infinito). • http://netty.io/news/2016/06/07/4-0-37-Final.html http://netty.io/news/2016/06/07/4-1-1-Final.html http://rhn.redhat.com/errata/RHSA-2017-0179.html http://rhn.redhat.com/errata/RHSA-2017-1097.html http://www.securityfocus.com/bid/96540 https://bugzilla.redhat.com/show_bug.cgi?id=1343616 https://github.com/netty/netty/pull/5364 https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassandra.apache.org%3E https://wiki • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.0EPSS: 1%CPEs: 15EXPL: 1CVE-2014-3488
https://notcve.org/view.php?id=CVE-2014-3488
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message. SslHandler en Netty anterior a 3.9.2 permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU) a través de un mensaje SSLv2Hello manipulado. • http://netty.io/news/2014/06/11/3-9-2-Final.html http://secunia.com/advisories/59196 https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994 https://github.com/netty/netty/issues/2562 https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 5%CPEs: 32EXPL: 0CVE-2014-0193 – netty: DoS via memory exhaustion during data aggregation
https://notcve.org/view.php?id=CVE-2014-0193
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames. WebSocket08FrameDecoder en Netty 3.6.x anterior a 3.6.9, 3.7.x anterior a 3.7.1, 3.8.x anterior a 3.8.2, 3.9.x anterior a 3.9.1 y 4.0.x anterior a 4.0.19 permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un TextWebSocketFrame seguido por una cadena larga de ContinuationWebSocketFrames. A flaw was found in the WebSocket08FrameDecoder implementation that could allow a remote attacker to trigger an Out Of Memory Exception by issuing a series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on the server configuration, this could lead to a denial of service. • http://netty.io/news/2014/04/30/release-day.html http://rhn.redhat.com/errata/RHSA-2014-1019.html http://rhn.redhat.com/errata/RHSA-2014-1020.html http://rhn.redhat.com/errata/RHSA-2014-1021.html http://rhn.redhat.com/errata/RHSA-2014-1351.html http://rhn.redhat.com/errata/RHSA-2015-0675.html http://rhn.redhat.com/errata/RHSA-2015-0720.html http://rhn.redhat.com/errata/RHSA-2015-0765.html http://secunia.com/advisories/58280 http://secunia.com/advisor • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •