Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 18.04 LTS USN-4532-1: Netty HTTP Smuggling Risks

ubuntu
Calendar Grey September 22, 2020
Dist Ubuntu Esm H88
Ubuntu 18.04 LTS has a security advisory regarding vulnerabilities in Netty that impact HTTP request handling. Users are urged to assess their systems and apply necessary patches
Several security issues were fixed in Netty.

Summary

Several security issues were fixed in Netty.

Software Description:

- netty-3.9: Asynchronous event-driven network application framework

Details:

It was discovered that Netty incorrectly handled certain HTTP headers.

By sending an HTTP header with whitespace before the colon, a remote

attacker could possibly use this issue to perform an HTTP request

smuggling attack. (CVE-2019-16869)

It was discovered that Netty incorrectly handled certain HTTP headers.

By sending an HTTP header that lacks a colon, a remote attacker could

possibly use this issue to perform an HTTP request smuggling attack.

(CVE-2019-20444)

It was discovered that Netty incorrectly handled certain HTTP headers.

By sending a Content-Length header accompanied by a second

Content-Length header, or by a Transfer-Encoding header, a remote

attacker could possibly use this issue to perform an HTTP request

smuggling attack. (CVE-2019-20445)

Topics%20covered

Topics Covered

security advisory Ubuntu network application HTTP request smuggling Netty

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
  libnetty-3.9-java               3.9.9.Final-1+deb9u1build0.18.04.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4532-1

CVE-2019-16869, CVE-2019-20444, CVE-2019-20445

Severity
critical
Lowest
Low
Medium
High
Critical

September 22, 2020

Topics%20covered

Topics Covered

security advisory Ubuntu network application HTTP request smuggling Netty

Package Information

https://launchpad.net/ubuntu/+source/netty-3.9/3.9.9.Final-1+deb9u1build0.18.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here