Fedora 33: FEDORA-2020-66b5f85ccc Critical: netty HTTP Request Issues

Netty is a NIO client server framework which enables quick and easy

development of network applications such as protocol servers and

clients. It greatly simplifies and streamlines network programming

such as TCP and UDP socket server.

'Quick and easy' doesn't mean that a resulting application will suffer

from a maintainability or a performance issue. Netty has been designed

carefully with the experiences earned from the implementation of a lot

of protocols such as FTP, SMTP, HTTP, and various binary and

text-based legacy protocols. As a result, Netty has succeeded to find

a way to achieve ease of development, performance, stability, and

flexibility without a compromise.

Updates to latest upstream releases.

* Mon Sep 7 2020 Mat Booth - 4.1.51-1

- Update to latest upstream version

- Native bits were not used by anything, so package is now noarch

[ 1 ] Bug #1796276 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1796276

[ 2 ] Bug #1798511 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1798511

[ 3 ] Bug #1798525 - CVE-2019-20444 netty: HTTP request smuggling [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1798525

[ 4 ] Bug #1818163 - jctools-3.0.0 is available

https://bugzilla.redhat.com/show_bug.cgi?id=1818163

[ 5 ] Bug #1865894 - CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1865894

su -c 'dnf upgrade --advisory FEDORA-2020-66b5f85ccc' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/