Vulnerability · Published Jan 27, 2020 · Assigned by mitre
CVE-2020-7238
High 7.5
In plain English
A high-severity security flaw in the netty package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.6%top 10.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | 1:4.1.45-1 | DEBIAN-CVE-2020-7238 |
| Debian:13 | netty | 1:4.1.45-1 | DEBIAN-CVE-2020-7238 |
| Debian:14 | netty | 1:4.1.45-1 | DEBIAN-CVE-2020-7238 |
| Maven | io.netty:netty-handler | 4.1.45 | GHSA-ff2w-cq2g-wv5f |
Affected products (as reported)
References
- https://netty.io/news/ x_refsource_MISC
- https://github.com/jdordonezn/CVE-2020-72381/issues/1 x_refsource_MISC
- RHSA-2020:0497 vendor-advisory, x_refsource_REDHAT
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2109-1] netty security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200219 [SECURITY] [DLA 2110-1] netty-3.9 security update mailing-list, x_refsource_MLIST
- RHSA-2020:0601 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0606 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0605 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0567 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0806 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0811 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0804 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0805 vendor-advisory, x_refsource_REDHAT
- [debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update mailing-list, x_refsource_MLIST
- FEDORA-2020-66b5f85ccc vendor-advisory, x_refsource_FEDORA
- DSA-4885 vendor-advisory, x_refsource_DEBIAN
- [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty mailing-list, x_refsource_MLIST
- [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16699) Security vulnerability CVE-2020-7238 for Netty mailing-list, x_refsource_MLIST