Количество 8
Количество 8
GHSA-wx5j-54mm-rqqq
HTTP request smuggling in netty
CVE-2021-43797
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
CVE-2021-43797
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
CVE-2021-43797
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.
CVE-2021-43797
Netty is an asynchronous event-driven network application framework fo ...
SUSE-SU-2022:2047-1
Security update for netty3
BDU:2023-08648
Уязвимость сетевого программного средства Netty, связанная с некорректной обработкой управляющих символов, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
SUSE-SU-2022:1271-1
Security update for netty
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-wx5j-54mm-rqqq HTTP request smuggling in netty | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
 | CVE-2021-43797 Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
 | CVE-2021-43797 Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
 | CVE-2021-43797 Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
| CVE-2021-43797 Netty is an asynchronous event-driven network application framework fo ... | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
 | SUSE-SU-2022:2047-1 Security update for netty3 | 3% Низкий | около 4 лет назад | |
 | BDU:2023-08648 Уязвимость сетевого программного средства Netty, связанная с некорректной обработкой управляющих символов, позволяющая нарушителю оказать воздействие на целостность защищаемой информации | CVSS3: 6.5 | 3% Низкий | больше 4 лет назад |
| SUSE-SU-2022:1271-1 Security update for netty | больше 4 лет назад |
Уязвимостей на страницу