Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:4489-1

Опубликовано: 19 дек. 2025
Источник: suse-cvrf

Описание

Security update for netty

This update for netty fixes the following issues:

Update to upstream version 4.1.130.

Security issues fixed:

  • CVE-2025-67735: lack of URI sanitization in HttpRequestEncoder allows for CRLF injection through a request URI and can lead to request smuggling (bsc#1255048).

Other updates and bugfixes:

  • Version 4.1.130:

    • Update lz4-java version to 1.10.1
    • Close Channel and fail bootstrap when setting a ChannelOption causes an error
    • Discard the following HttpContent for preflight request
    • Fix race condition in NonStickyEventExecutorGroup causing incorrect inEventLoop() results
    • Fix Zstd compression for large data
    • Fix ZstdEncoder not producing data when source is smaller than block
    • Make big endian ASCII hashcode consistent with little endian
    • Fix reentrancy bug in ByteToMessageDecoder
    • Add 32k and 64k size classes to adaptive allocator
    • Re-enable reflective field accesses in native images
    • Correct HTTP/2 padding length check
    • Fix HTTP startline validation
    • Fix MpscIntQueue bug

  • Build against the org.jboss:jdk-misc artifact that is implementing the sun.misc classes removed in Java 25

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP7
netty-4.1.130-150200.4.40.1
netty-javadoc-4.1.130-150200.4.40.1
openSUSE Leap 15.6
netty-4.1.130-150200.4.40.1
netty-javadoc-4.1.130-150200.4.40.1

Ссылки

Описание

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.130-150200.4.40.1
SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.130-150200.4.40.1
openSUSE Leap 15.6:netty-4.1.130-150200.4.40.1
openSUSE Leap 15.6:netty-javadoc-4.1.130-150200.4.40.1
Ссылки