PT-2021-7977 · Oracle+4 · Java+4
R00T4Dm
·
Published
2021-02-08
·
Updated
2026-05-18
·
CVE-2022-24823
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
io.netty:netty-codec-http versions prior to 4.1.77.Final
Description
The issue is related to insufficient fix for a vulnerability in Netty's multipart decoders, which can lead to local information disclosure via the local system temporary directory if temporary storing uploads on the disk is enabled. This affects applications running on Java version 6 and lower, as well as code running on Unix-like systems, and very old versions of Mac OSX and Windows, as they share the system temporary directory between all users.
Recommendations
For versions prior to 4.1.77.Final, update to 4.1.77.Final to fix the vulnerability.
As a workaround, specify your own
java.io.tmpdir when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.
Alternatively, update to Java 7 or above to mitigate the issue.Exploit
Fix
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Java
Linuxmint
Suse
Ubuntu