PT-2017-6553 · Netty+1 · Netty+1

Luca Carettoni + 2 · Publicado 2017-10-18 · Atualizado 2020-06-30 · CVE-2015-2156

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netty versions 3.9.7 and earlier, 3.10.x prior to 3.10.3.Final, 4.0.x prior to 4.0.28.Final, 4.1.x prior to 4.1.0.Beta5 Play Framework versions 2.x prior to 2.3.9

Description The issue allows remote attackers to bypass the httpOnly flag on cookies, potentially obtaining sensitive information. This is due to improper validation of cookie name and value characters.

Recommendations For Netty versions 3.9.7 and earlier, update to version 3.9.8.Final or later. For Netty versions 3.10.x prior to 3.10.3.Final, update to version 3.10.3.Final or later. For Netty versions 4.0.x prior to 4.0.28.Final, update to version 4.0.28.Final or later. For Netty versions 4.1.x prior to 4.1.0.Beta5, update to version 4.1.0.Beta5 or later. For Play Framework versions 2.x prior to 2.3.9, update to version 2.3.9 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-2156

GHSA-XFV3-RRFM-F2RV

Produtos afetados

Netty

Play Framework

Referências · 31

• https://github.com/netty/netty · Nota
• https://github.com/netty/netty/pull/3748/commits/4ac519f534493bb0ca7a77e1c779138a54faa7b9 · Nota
• https://github.com/netty/netty/commit/31815598a2af37f0b71ea94eada70d6659c23752 · Nota
• https://github.com/netty/netty/pull/3754 · Nota
• https://github.com/netty/netty/commit/2caa38a2795fe1f1ae6ceda4d69e826ed7c55e55 · Nota
• https://playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass · Nota
• https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E · Nota
• ❌ https://github.com/slandelle/netty/commit/800555417e77029dcf8a31d7de44f27b5a8f79b8 · Nota, Deleted
• http://engineering.linkedin.com/security/look-netty%E2%80%99s-recent-security-update-cve%C2%AD-2015%C2%AD-2156 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2156 · Nota de Segurança
• https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3@%3Ccommits.cassandra.apache.org%3E · Nota
• http://openwall.com/lists/oss-security/2015/05/17/1 · Nota
• https://osv.dev/vulnerability/GHSA-xfv3-rrfm-f2rv · Aviso do Fabricante