https://bugzilla.redhat.com/show_bug.cgi?id=1222923
Bug ID: 1222923
Summary: CVE-2015-2156 netty: HttpOnly cookie bypass
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
asantos(a)redhat.com, aszczucz(a)redhat.com,
bdawidow(a)redhat.com, bkearney(a)redhat.com,
brms-jira(a)redhat.com, cbillett(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cpelland(a)redhat.com, cperry(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
epp-bugs(a)redhat.com, etirelli(a)redhat.com,
felias(a)redhat.com, fnasser(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hfnukal(a)redhat.com, huwang(a)redhat.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jerboaa(a)gmail.com,
jolee(a)redhat.com, jon.vanalten(a)redhat.com,
jpallich(a)redhat.com, katello-bugs(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mbaluch(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com,
mweiler(a)redhat.com, mwinkler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohadlevy(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pslavice(a)redhat.com,
rhq-maint(a)redhat.com, rrajasek(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com,
tomckay(a)redhat.com, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
A flaw was found in the way Netty’s CookieDecoder method validated cookie name
and value characters. An attacker could use this flaw to bypass the httpOnly
flag on sensitive cookies.
Upstream patch:
https://github.com/slandelle/netty/commit/800555417e77029dcf8a31d7de44f27...
External References:
https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOn...
http://engineering.linkedin.com/security/look-netty%E2%80%99s-recent-secu...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=Vfly1r8bG5&a=cc_unsubscribe