Описание
A flaw was found in the netty-codec-haproxy component, part of the Netty network application framework. This vulnerability allows a remote attacker to perform protocol-level injection attacks by crafting malformed HAProxy protocol frames that contain embedded carriage return (CR) and line feed (LF) sequences. This can lead to the injection of arbitrary content, potentially disrupting network communication or enabling further attacks.
Отчет
This Moderate flaw in netty-codec-haproxy allows for protocol-level injection attacks due to improper neutralization of CR/LF sequences. An attacker could exploit this by crafting malformed HAProxy protocol frames to inject arbitrary content, potentially leading to unexpected behavior or further attacks within the affected application's protocol handling. This vulnerability impacts multiple Red Hat products that incorporate the netty-codec-haproxy component.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | netty-codec-haproxy | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-ekb-dispatcher-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-ekb-receiver-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Уязвимость классов HAProxyMessage, HAProxyMessageEncoder фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю подменить данные
5.5 Medium
CVSS3