HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0601 advisory.

  - netty: HTTP request smuggling (CVE-2019-20444)

  - netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header     (CVE-2019-20445)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in Netty, a Java NIO client/server framework, which could result in HTTP request smuggling, denial of service or information disclosure.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4600-2 advisory.

  - HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be     interpreted as a separate header with an incorrect syntax, or might be interpreted as an invalid fold.
    (CVE-2019-20444)

  - HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second     Content-Length header, or by a Transfer-Encoding header. (CVE-2019-20445)

  - The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a     ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server,     forcing the server to allocate all of its free memory to a single decoder. (CVE-2020-11612)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4600-1 advisory.

  - Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a Transfer-     Encoding : chunked line), which leads to HTTP request smuggling. (CVE-2019-16869)

  - HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be     interpreted as a separate header with an incorrect syntax, or might be interpreted as an invalid fold.
    (CVE-2019-20444)

  - HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second     Content-Length header, or by a Transfer-Encoding header. (CVE-2019-20445)

  - Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such     as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because     of an incomplete fix for CVE-2019-16869. (CVE-2020-7238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4532-1 advisory.

  - Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a Transfer-     Encoding : chunked line), which leads to HTTP request smuggling. (CVE-2019-16869)

  - HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be     interpreted as a separate header with an incorrect syntax, or might be interpreted as an invalid fold.
    (CVE-2019-20444)

  - HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second     Content-Length header, or by a Transfer-Encoding header. (CVE-2019-20445)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in netty-3.9, a Java NIO client/server socket framework.

CVE-2019-16869

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a 'Transfer-Encoding : chunked' line), which leads to HTTP request smuggling.

CVE-2019-20444

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'

CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

For Debian 9 stretch, these problems have been fixed in version 3.9.9.Final-1+deb9u1.

We recommend that you upgrade your netty-3.9 packages.

For the detailed security status of netty-3.9 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/netty-3.9

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in netty, a Java NIO client/server socket framework.

CVE-2019-20444

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'

CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVE-2020-7238

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

For Debian 9 stretch, these problems have been fixed in version 1:4.1.7-2+deb9u2.

We recommend that you upgrade your netty packages.

For the detailed security status of netty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/netty

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0806 advisory.

  - thrift: Endless loop when feed with specific input data (CVE-2019-0205)

  - thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

  - apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

  - xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source     (CVE-2019-12400)

  - wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is     in use (CVE-2019-14887)

  - netty: HTTP request smuggling (CVE-2019-20444)

  - netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header     (CVE-2019-20445)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0805 advisory.

  - thrift: Endless loop when feed with specific input data (CVE-2019-0205)

  - thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

  - apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

  - xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source     (CVE-2019-12400)

  - wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is     in use (CVE-2019-14887)

  - netty: HTTP request smuggling (CVE-2019-20444)

  - netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header     (CVE-2019-20445)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0804 advisory.

  - thrift: Endless loop when feed with specific input data (CVE-2019-0205)

  - thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

  - apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

  - xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source     (CVE-2019-12400)

  - wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is     in use (CVE-2019-14887)

  - netty: HTTP request smuggling (CVE-2019-20444)

  - netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header     (CVE-2019-20445)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0605 advisory.

  - netty: HTTP request smuggling (CVE-2019-20444)

  - netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header     (CVE-2019-20445)

  - netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Netty, a Java NIO client/server socket framework :

CVE-2014-0193

WebSocket08FrameDecoder allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

CVE-2014-3488

The SslHandler allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2019-16869

Netty mishandles whitespace before the colon in HTTP headers (such as a 'Transfer-Encoding : chunked' line), which leads to HTTP request smuggling.

CVE-2019-20444

HttpObjectDecoder.java allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'

CVE-2019-20445

HttpObjectDecoder.java allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVE-2020-7238

Netty allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.

For Debian 8 'Jessie', these problems have been fixed in version 3.9.0.Final-1+deb8u1.

We recommend that you upgrade your netty-3.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the HTTP server provided by Netty, a Java NIO client/server socket framework :

CVE-2019-20444

HttpObjectDecoder.java allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'

CVE-2019-20445

HttpObjectDecoder.java allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVE-2020-7238

Netty allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.

For Debian 8 'Jessie', these problems have been fixed in version 1:3.2.6.Final-2+deb8u2.

We recommend that you upgrade your netty packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
170341	RHEL 6 / 7 / 8 : AMQ Clients 2.6.0 Release (Important) (RHSA-2020:0601)	Nessus	Red Hat Local Security Checks	critical
148326	Debian DSA-4885-1 : netty - security update	Nessus	Debian Local Security Checks	critical
141934	Ubuntu 18.04 LTS : Netty vulnerabilities (USN-4600-2)	Nessus	Ubuntu Local Security Checks	critical
141822	Ubuntu 16.04 LTS : Netty vulnerabilities (USN-4600-1)	Nessus	Ubuntu Local Security Checks	critical
140753	Ubuntu 18.04 LTS : Netty vulnerabilities (USN-4532-1)	Nessus	Ubuntu Local Security Checks	critical
140296	Debian DLA-2365-1 : netty-3.9 security update	Nessus	Debian Local Security Checks	critical
140295	Debian DLA-2364-1 : netty security update	Nessus	Debian Local Security Checks	critical
134614	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 (RHSA-2020:0806)	Nessus	Red Hat Local Security Checks	critical
134613	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 (RHSA-2020:0805)	Nessus	Red Hat Local Security Checks	critical
134612	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 (RHSA-2020:0804)	Nessus	Red Hat Local Security Checks	critical
134098	RHEL 6 / 8 : Red Hat JBoss Enterprise Application Platform 7.2 (RHSA-2020:0605)	Nessus	Red Hat Local Security Checks	critical
133814	Debian DLA-2110-1 : netty-3.9 security update	Nessus	Debian Local Security Checks	critical
133813	Debian DLA-2109-1 : netty security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-20445

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical