Описание
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when HttpRequestEncoder is used without proper sanitization of the URI. Any application / framework using HttpRequestEncoder can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps-legacy/xenial | released | 1:4.0.34-1ubuntu0.1~esm5 |
| esm-apps/bionic | released | 1:4.1.7-4ubuntu0.1+esm7 |
| esm-apps/focal | released | 1:4.1.45-1ubuntu0.1~esm7 |
| esm-apps/jammy | released | 1:4.1.48-4+deb11u2ubuntu0.2+esm1 |
| esm-apps/noble | released | 1:4.1.48-9ubuntu0.2+esm1 |
| esm-apps/resolute | not-affected | 1:4.1.48-15 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | ignored | changes too intrusive |
| jammy | released | 1:4.1.48-4+deb11u2ubuntu0.2 |
Показывать по
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when `HttpRequestEncoder` is used without proper sanitization of the URI. Any application / framework using `HttpRequestEncoder` can be subject to be abused to perform request smuggling using CRLF injection. Versions 4.1.129.Final and 4.2.8.Final fix the issue.
Netty is an asynchronous, event-driven network application framework. ...
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
EPSS
6.5 Medium
CVSS3