Multiple security issues were discovered in Netty, a Java NIO client/server framework, which could result in HTTP request smuggling, denial of service or information disclosure.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:10208 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.8 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.7, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.8 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible [eap-7.1.z]     (CVE-2020-28052)

    * hsqldb: Untrusted input may lead to RCE attack [eap-7.1.z] (CVE-2022-41853)

    * cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding [eap-7.1.z] (CVE-2024-28752)

    * h2: Loading of custom classes from remote servers through JNDI [eap-7.1.z] (CVE-2022-23221)

    * CXF: Apache CXF: SSRF Vulnerability [eap-7.1.z] (CVE-2022-46364)

    * xalan: integer truncation issue in Xalan-J (JAXP, 8285407) [eap-7.1.z] (CVE-2022-34169)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging [eap-7.1.z] (CVE-2023-26464)

    * xnio: StackOverflowException when the chain of notifier states becomes problematically big [eap-7.1.z]     (CVE-2023-5685)

    * server: eap-7: heap exhaustion via deserialization [eap-7.1.z] (CVE-2023-3171)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling [eap-7.1.z]     (CVE-2020-7238)

    * avro: apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK     [eap-7.1.z] (CVE-2023-39410)

    * avro: apache-avro: Schema parsing may trigger Remote Code Execution (RCE) [eap-7.1.z] (CVE-2024-47561)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0804 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.6, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.7 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean     by default (CVE-2019-10086)

    * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210)

    * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source     (CVE-2019-12400)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

    * netty: HTTP request smuggling (CVE-2019-20444)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header (CVE-2019-20445)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 53caf29b-9180-11ed-acbe-b42e991fc52e advisory.

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported     versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2019-2684)

  - Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such     as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because     of an incomplete fix for CVE-2019-16869. (CVE-2020-7238)

  - Netty is an open-source, asynchronous event-driven network application framework. The package     `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290.
    When Netty's multipart decoders are used local information disclosure can occur via the local system     temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications     running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like     systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory     between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify     one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the     directory to something that is only readable by the current user. (CVE-2022-24823)

  - The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due     missing to nested depth limitation for collections. (CVE-2022-25857)

  - In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a     check in primitive value deserializers to avoid deep wrapper array nesting, when the     UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1     (CVE-2022-42003)

  - In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in     BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is     vulnerable only with certain customized choices for deserialization. (CVE-2022-42004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in netty, a Java NIO client/server socket framework.

CVE-2019-20444

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'

CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVE-2020-7238

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

For Debian 9 stretch, these problems have been fixed in version 1:4.1.7-2+deb9u2.

We recommend that you upgrade your netty packages.

For the detailed security status of netty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/netty

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0806 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.2.6, and     includes bug fixes and enhancements. See the Red Hat JBoss Enterprise     Application Platform 7.2.7 Release Notes for information about the most     significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class     property in PropertyUtilsBean by default (CVE-2019-10086)

    * libthrift: thrift: Endless loop when feed with specific input data     (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or     TSimpleJSONProtocol (CVE-2019-0210)

    * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from     an untrusted source (CVE-2019-12400)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

    * netty: HTTP request smuggling (CVE-2019-20444)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header (CVE-2019-20445)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
148326	Debian DSA-4885-1 : netty - security update	Nessus	Debian Local Security Checks	4/6/2021	1/12/2024	critical
211909	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 (RHSA-2024:10208)	Nessus	Red Hat Local Security Checks	11/27/2024	11/24/2025	critical
134612	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 6 (RHSA-2020:0804)	Nessus	Red Hat Local Security Checks	3/16/2020	11/7/2024	critical
169936	FreeBSD : cassandra3 -- multiple vulnerabilities (53caf29b-9180-11ed-acbe-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	1/12/2023	9/7/2023	high
140295	Debian DLA-2364-1 : netty security update	Nessus	Debian Local Security Checks	9/8/2020	2/21/2024	critical
134614	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 (RHSA-2020:0806)	Nessus	Red Hat Local Security Checks	3/16/2020	11/7/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

high

critical

critical