Red Hat Security AdvisoryRHSA-2020:0605
Red Hat JBoss Enterprise Application Platform 7.2 security update
Released 2020-02-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-netty-4.1.45-1.Final_redhat_00001.1.el6eap, eap7-netty-all-4.1.45-1.Final_redhat_00001.1.el6eap
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-netty-4.1.45-1.Final_redhat_00001.1.el7eap, eap7-netty-all-4.1.45-1.Final_redhat_00001.1.el7eap
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-netty-4.1.45-1.Final_redhat_00001.1.el8eap, eap7-netty-all-4.1.45-1.Final_redhat_00001.1.el8eap
Fixes 3 records
Priority MEDIUM 62
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.13834 · Published 2020-01-29 · Partial fix · 4.1.45 CWE-444
Priority MEDIUM 59
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.08914 · Published 2020-01-29 · Partial fix · 4.1.44 CWE-444
Priority LOW 39
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03647 · Published 2020-01-27 · Partial fix · 4.1.45 CWE-444
THREATIST.IORead the docs