Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Debian Jessie: DLA-2109-1 Critical: Netty HTTP Server Issues

debian lts
Calendar Grey February 19, 2020
Dist Debian Esm H88
Upgrade the Netty libraries to address critical HTTP server vulnerabilities on Debian Jessie and enhance system security for safer operations
Several vulnerabilities were discovered in the HTTP server provided by Netty, a Java NIO client/server socket framework:
Topics%20covered

Topics Covered

security advisory security issue critical debian netty http server response error

Summary

CVE-2019-20444

HttpObjectDecoder.java allows an HTTP header that lacks a colon,
which might be interpreted as a separate header with an incorrect
syntax, or might be interpreted as an "invalid fold."

CVE-2019-20445

HttpObjectDecoder.java allows a Content-Length header to be
accompanied by a second Content-Length header, or by a
Transfer-Encoding header.

CVE-2020-7238

Netty allows HTTP Request Smuggling because it mishandles
Transfer-Encoding whitespace (such as a
[space]Transfer-Encoding:chunked line) and a later Content-Length
header.

For Debian 8 "Jessie", these problems have been fixed in version
1:3.2.6.Final-2+deb8u2.

We recommend that you upgrade your netty packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: netty
Version: 1:3.2.6.Final-2+deb8u2
CVE ID: CVE-2019-20444 CVE-2019-20445 CVE-2020-7238
Debian Bug: 950966 950967

Topics%20covered

Topics Covered

security advisory security issue critical debian netty http server response error

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here