CVE-2022-41915

 

Published at: - 13-12-2022 08:15

Last modified: - 13-01-2023 10:15

Total changes: - 6

Description

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp
• https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4
• https://github.com/netty/netty/pull/12760
• https://github.com/netty/netty/issues/13084
• [debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update-
• DSA-5316-
• https://security.netapp.com/advisory/ntap-20230113-0004/

 

Keywords

NVD

 

CVE-2022-41915

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures