Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1oaDgyLTNwbXEtN2ZycM4AAwRo
Netty vulnerable to HTTP Response splitting from assigning header value iterator
Impact
When calling DefaultHttpHeaders.set
with an iterator of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting.
Patches
The necessary validation was added in Netty 4.1.86.Final.
Workarounds
Integrators can work around the issue by changing the DefaultHttpHeaders.set(CharSequence, Iterator<?>)
call, into a remove()
call, and call add()
in a loop over the iterator of values.
References
HTTP Response Splitting
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
For more information
If you have any questions or comments about this advisory:
- Open an issue in [example link to repo](https://github.com/netty/netty)
- Email us at [email protected]
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oaDgyLTNwbXEtN2ZycM4AAwRo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: over 1 year ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Identifiers: GHSA-hh82-3pmq-7frp, CVE-2022-41915
References:
- https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp
- https://nvd.nist.gov/vuln/detail/CVE-2022-41915
- https://github.com/netty/netty/issues/13084
- https://github.com/netty/netty/pull/12760
- https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4
- https://github.com/netty/netty/commit/c37c637f096e7be3dffd36edee3455c8e90cb1b0
- https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
- https://www.debian.org/security/2023/dsa-5316
- https://security.netapp.com/advisory/ntap-20230113-0004/
- https://github.com/advisories/GHSA-hh82-3pmq-7frp
Blast Radius: 24.8
Affected Packages
maven:io.netty:netty-codec-http
Dependent packages: 1,324Dependent repositories: 6,505
Downloads:
Affected Version Ranges: >= 4.1.83.Final, < 4.1.86.Final
Fixed in: 4.1.86.Final
All affected versions: 4.1.8-3.Final, 4.1.8-4.Final, 4.1.8-5.Final
All unaffected versions: