Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Project Subscriptions

Vendors Products
Debian Linux Subscribe
Fedoraproject Subscribe
A Mq Clients Subscribe
Amq Broker Subscribe
Amq Online Subscribe
Amq Streams Subscribe
Jboss Data Grid Subscribe
Jboss Enterprise Application Platform Subscribe
Jboss Enterprise Application Platform Cd Subscribe
Jboss Enterprise Application Platform Eus Subscribe
Jboss Enterprise Application Platform Text-only Advisories Subscribe
Jboss Enterprise Bpms Platform Subscribe
Jboss Enterprise Brms Platform Subscribe
Jboss Fuse Subscribe
Jboss Single Sign On Subscribe
Openshift Application Runtimes Subscribe
Openshift Application Runtimes Text-only Advisories Subscribe
Satellite Subscribe
Satellite Capsule Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-2109-1 netty security update
Debian DLA Debian DLA DLA-2110-1 netty-3.9 security update
Debian DLA Debian DLA DLA-2364-1 netty security update
Debian DSA Debian DSA DSA-4885-1 netty security update
EUVD EUVD EUVD-2020-0303 Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Github GHSA Github GHSA GHSA-ff2w-cq2g-wv5f HTTP Request Smuggling in Netty
Ubuntu USN Ubuntu USN USN-4600-1 Netty vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Mon, 25 Nov 2024 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat jboss Enterprise Application Platform Eus
CPEs cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7
Vendors & Products Redhat jboss Enterprise Application Platform Eus

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-04T09:25:48.271Z

Reserved: 2020-01-20T00:00:00

Link: CVE-2020-7238

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-01-27T17:15:12.277

Modified: 2024-11-21T05:36:53.793

Link: CVE-2020-7238

cve-icon Redhat

Severity : Important

Publid Date: 2020-01-26T00:00:00Z

Links: CVE-2020-7238 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses