Описание
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
A flaw was found in Netty, where it mishandles Transfer-Encoding whitespace. This flaw allows HTTP Request Smuggling.
Отчет
OpenShift Container Platform ships a vulnerable netty library as part of the logging-elasticsearch5 container. ElasticSearch's security team has stated that the previous vulnerability, CVE-2019-16869, does not poses a substantial practical threat to ElasticSearch 6 [1]. We agree that this issue would be difficult to exploit both these vulnerabilities on OpenShift Container Platform, so we're reducing the impact of this issue to moderate and may fix it in the future release. Red Hat Satellite ships vulnerable netty version embedded in Candlepin, however, is not directly vulnerable since HTTP requests are handled by Tomcat and not netty. [1] https://github.com/elastic/elasticsearch/issues/49396
Меры по смягчению последствий
- Use HTTP/2 instead (clear boundaries between requests)
- Disable reuse of backend connections eg.
http-reuse neverin HAProxy or whatever equivalent LB settings
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | netty | Out of support scope | ||
| Red Hat Enterprise MRG 3 | netty-all | Out of support scope | ||
| Red Hat JBoss A-MQ 6 | netty | Out of support scope | ||
| Red Hat JBoss BRMS 6 | netty | Out of support scope | ||
| Red Hat JBoss Data Virtualization 6 | netty | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 5 | netty | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | netty | Out of support scope | ||
| Red Hat JBoss Fuse 6 | netty | Out of support scope | ||
| Red Hat JBoss Fuse Service Works 6 | netty | Out of support scope | ||
| Red Hat JBoss Operations Network 3 | netty | Will not fix |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles ...
7.5 High
CVSS3