Описание
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.
Отчет
In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package. Since the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix. The openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase. A fix was introduced in netty-codec-http version 4.1.72.Final.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | netty | Affected | ||
| Red Hat A-MQ Online | netty | Not affected | ||
| Red Hat JBoss A-MQ 6 | netty | Out of support scope | ||
| Red Hat JBoss Data Grid 7 | netty | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 5 | netty | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 6 | netty | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | netty | Not affected | ||
| Red Hat JBoss Fuse 6 | netty | Out of support scope | ||
| Red Hat JBoss Operations Network 3 | netty | Out of support scope | ||
| Red Hat OpenShift Application Runtimes | netty | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
Netty is an asynchronous event-driven network application framework fo ...
EPSS
6.5 Medium
CVSS3