PT-2017-6553 · Netty+1 · Netty+1

Luca Carettoni + 2 · Published 2017-10-18 · Updated 2020-06-30 · CVE-2015-2156

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netty versions 3.9.7 and earlier, 3.10.x prior to 3.10.3.Final, 4.0.x prior to 4.0.28.Final, 4.1.x prior to 4.1.0.Beta5 Play Framework versions 2.x prior to 2.3.9

Description The issue allows remote attackers to bypass the httpOnly flag on cookies, potentially obtaining sensitive information. This is due to improper validation of cookie name and value characters.

Recommendations For Netty versions 3.9.7 and earlier, update to version 3.9.8.Final or later. For Netty versions 3.10.x prior to 3.10.3.Final, update to version 3.10.3.Final or later. For Netty versions 4.0.x prior to 4.0.28.Final, update to version 4.0.28.Final or later. For Netty versions 4.1.x prior to 4.1.0.Beta5, update to version 4.1.0.Beta5 or later. For Play Framework versions 2.x prior to 2.3.9, update to version 2.3.9 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-2156

GHSA-XFV3-RRFM-F2RV

Affected Products

Netty

Play Framework

References · 31

• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2156 · Security Note
• https://osv.dev/vulnerability/GHSA-xfv3-rrfm-f2rv · Vendor Advisory
• http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-2156 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-2156 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-2156 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2156 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2156 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-2156 · Security Note
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/pull/3748/commits/4ac519f534493bb0ca7a77e1c779138a54faa7b9 · Note
• https://github.com/netty/netty/commit/31815598a2af37f0b71ea94eada70d6659c23752 · Note
• https://github.com/netty/netty/pull/3754 · Note