https://bugzilla.redhat.com/show_bug.cgi?id=1798509
Bug ID: 1798509
Summary: CVE-2019-20445 netty: HttpObjectDecoder.java allows
Content-Length header to accompanied by second
Content-Length header
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ganandan(a)redhat.com,
ggaughan(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jerboaa(a)gmail.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jross(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, rchan(a)redhat.com,
rguimara(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sdaley(a)redhat.com, smaestri(a)redhat.com,
sochotni(a)redhat.com, sokeeffe(a)redhat.com,
spinder(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, tbrisker(a)redhat.com,
theute(a)redhat.com, tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in HttpObjectDecoder.java in Netty before 4.1.44
allows a Content-Length header to be accompanied by a second Content-Length
header, or by a Transfer-Encoding header.
Reference:
https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44....
https://github.com/netty/netty/issues/9861
https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c879...
https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b1079...
https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e...
https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd3326...
https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df8...
https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f...
https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535...
https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8...
https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755...
https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4...
https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae2629...
https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c...
https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd2...
https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa8482090...
--
You are receiving this mail because:
You are on the CC list for the bug.