DSA-4597: -1 netty -- security update
Published Jan 3, 2020
·Updated
It was reported that Netty, a Java NIO client/server framework, is prone to a HTTP request smuggling vulnerability due to mishandling whitespace before the colon in HTTP headers.
Affected Software
2 affected components
debian/netty
debian/netty
Event History
Jan 3, 2020
Advisory Published
12:00 AM
Frequently Asked Questions
1
What HTTP traffic is relevant to this issue?
The issue concerns HTTP requests containing whitespace before the colon in header fields. Deployments using Netty to process HTTP requests are the relevant exposure point.
2
What is the underlying attack technique?
The reported weakness is HTTP request smuggling. It results from Netty mishandling whitespace before the colon in HTTP headers.
3
Where can I identify the tracked vulnerability?
The Debian security tracker reference identifies this issue as CVE-2019-16869. The Debian bug reference is bug 941266.