CVE-2022-41915
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0027
Percentile
0,5th
Updated
EPSS Score Trend (Last 90 Days)
113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Access Control
Potential Impacts:
Modify Application Data
Gain Privileges Or Assume Identity
Applicable Platforms
Technologies:
Web Based, Web Server
436
Interpretation Conflict
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Other
Potential Impacts:
Unexpected State
Varies By Context
Applicable Platforms
All platforms may be affected
Operating System
Debian Linux by Debian
CPE Identifier
View Detailed Analysis
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Netty by Netty
Version Range Affected
From
4.1.83
(inclusive)
To
4.1.86
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Debian Linux by Debian
CPE Identifier
View Detailed Analysis
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4
https://github.com/netty/netty/issues/13084
https://github.com/netty/netty/pull/12760
https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp
https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
https://security.netapp.com/advisory/ntap-20230113-0004/
https://www.debian.org/security/2023/dsa-5316
https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4
https://github.com/netty/netty/issues/13084
https://github.com/netty/netty/pull/12760
https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp
https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
https://security.netapp.com/advisory/ntap-20230113-0004/
https://www.debian.org/security/2023/dsa-5316