CVE-2020-7238

Published: Jan 27, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Affected (10)

Products: Netty: Netty · Fedoraproject: Fedora · Debian: Debian Linux · +1 more

Show all products

Netty: Netty · Fedoraproject: Fedora · Debian: Debian Linux · Redhat: Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Text Only Advisories, Openshift Application Runtimes Text Only Advisories

1 product

1 product

1 product

3 products

Jboss Enterprise Application Platform

Jboss Enterprise Application Platform Text Only Advisories

Openshift Application Runtimes Text Only Advisories

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netty Netty	Version 4.1.43

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 7.2
Redhat Jboss Enterprise Application Platform	Version 7.3
Redhat Jboss Enterprise Application Platform	Version 7.4
Redhat Jboss Enterprise Application Platform Text Only Advisories	All versions
Redhat Openshift Application Runtimes Text Only Advisories	All versions

Related CWEs

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (36)

https://access.redhat.com/errata/RHSA-2020:0497

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0567

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0601

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0605

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0606

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0804

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0805

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0806

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0811

Source: cve@mitre.org

Third Party Advisory

https://github.com/jdordonezn/CVE-2020-72381/issues/1

Source: cve@mitre.org

ExploitThird Party Advisory

https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7%40%3Ccommits.cassandra.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05%40%3Ccommits.cassandra.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/

Source: cve@mitre.org

https://netty.io/news/

Source: cve@mitre.org

Vendor Advisory

https://www.debian.org/security/2021/dsa-4885

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0497

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0567

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0601

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0605

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0606

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0804

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0805

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0806

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0811

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/jdordonezn/CVE-2020-72381/issues/1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://lists.apache.org/thread.html/r131e572d003914843552fa45c4398b9903fb74144986e8b107c0a3a7%40%3Ccommits.cassandra.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rc8d554aad889d12b140d9fd7d2d6fc2e8716e9792f6f4e4b2cdc2d05%40%3Ccommits.cassandra.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/

Source: af854a3a-2127-422b-91ae-364da2661108

https://netty.io/news/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.debian.org/security/2021/dsa-4885

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.