USN-4532-1: Netty vulnerabilities

Details

It was discovered that Netty incorrectly handled certain HTTP headers.
By sending an HTTP header with whitespace before the colon, a remote
attacker could possibly use this issue to perform an HTTP request
smuggling attack. (CVE-2019-16869)

It was discovered that Netty incorrectly handled certain HTTP headers.
By sending an HTTP header that lacks a colon, a remote attacker could
possibly use this issue to perform an HTTP request smuggling attack.
(CVE-2019-20444)

It was discovered that Netty incorrectly handled certain HTTP headers.
By sending a Content-Length header accompanied by a second Content-Length
header, or by a Transfer-Encoding header, a remote attacker could possibly
use this issue to perform an HTTP request smuggling attack.
(CVE-2019-20445)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• libnetty-3.9-java - 3.9.9.Final-1+deb9u1build0.18.04.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2019-16869
• CVE-2019-20444
• CVE-2019-20445

Related notices

• USN-4600-1: libnetty-3.9-java, netty-3.9
• USN-4600-2: netty, libnetty-java