PT-2019-6161 · Netty+3 · Netty+3
Ethern Su
·
Publicado
2019-12-09
·
Atualizado
2025-08-19
·
CVE-2020-7238
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Netty version 4.1.43.Final
Description
The issue is related to HTTP Request Smuggling due to the mishandling of Transfer-Encoding whitespace and a later Content-Length header. This is a result of an incomplete fix for a previous issue. The vulnerability is associated with a flaw in interpreting HTTP requests, which could allow a remote attacker to impact data integrity.
Recommendations
For Netty version 4.1.43.Final, consider disabling the HTTP request processing functionality until a patch is available. Restrict access to the affected module to minimize the risk of exploitation. Avoid using the
Transfer-Encoding and Content-Length headers in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Netty
Red Os
Ubuntu