GitHub Advisoryadvisory · Maven

GHSA-xfv3-rrfm-f2rv Information Exposure in Netty

HIGH Published 2020-06-30 Modified 2021-09-22 Official page ↗
Aliases
CVE-2015-2156
Ecosystem
Maven
Packages
io.netty:netty-parent, org.jboss.netty:netty, io.netty:netty
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2020-06-30

Affected packages

• Maven io.netty:netty-parent: >= 4.0.0, < 4.0.28.Final → fixed in 4.0.28.Final • Maven org.jboss.netty:netty: < 3.9.8.Final → fixed in 3.9.8.Final • Maven org.jboss.netty:netty: >= 3.10.0, < 3.10.3.Final → fixed in 3.10.3.Final • Maven io.netty:netty: >= 3.10.0, < 3.10.3.Final → fixed in 3.10.3.Final • Maven io.netty:netty: < 3.9.8.Final → fixed in 3.9.8.Final

Description

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Related

Alias · CVE (1)

  • CVE-2015-2156 Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References