- Vulnerability/
- USN-4600-2
USN-4600-2: Netty vulnerabilities
First published: Tue Oct 27 2020(Updated: )
USN-4600-1 fixed multiple vunerabilities in Netty 3.9. This update provides the corresponding fixes for CVE-2019-20444, CVE-2019-20445 for Netty. Also it was discovered that Netty allow for unbounded memory allocation. A remote attacker could send a large stream to the Netty server causing it to crash (denial of service). (CVE-2020-11612) Original advisory details: It was discovered that Netty had HTTP request smuggling vulnerabilities. A remote attacker could used it to extract sensitive information. (CVE-2019-16869, CVE-2019-20444, CVE-2019-20445, CVE-2020-7238)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/libnetty-java | <1:4.1.7-4ubuntu0.1 | 1:4.1.7-4ubuntu0.1 |
| =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2019-20444
- https://ubuntu.com/security/CVE-2020-11612
- https://ubuntu.com/security/CVE-2019-20445
- https://ubuntu.com/security/notices/USN-4532-1
- https://ubuntu.com/security/notices/USN-4600-1
- https://ubuntu.com/security/notices/USN-6049-1
- https://launchpad.net/ubuntu/+source/netty/1:4.1.7-4ubuntu0.1
- https://ubuntu.com/security/notices/USN-4600-2 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What vulnerabilities does USN-4600-2 address?
USN-4600-2 addresses the CVE-2019-20444 and CVE-2019-20445 vulnerabilities in Netty.
How can a remote attacker exploit the Netty vulnerability?
A remote attacker can exploit the Netty vulnerability by sending a large stream to the Netty server, causing it to crash.
What versions of libnetty-java are affected by USN-4600-2?
USN-4600-2 affects libnetty-java version 1:4.1.7-4ubuntu0.1.
How can I fix the Netty vulnerability?
To fix the Netty vulnerability, update to libnetty-java version 1:4.1.7-4ubuntu0.1.
Where can I find more information about the Netty vulnerabilities?
You can find more information about the Netty vulnerabilities in the USN-4600-2 advisory.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/usn
- source/Ubuntu
- anchor-related/USN-4532-1
- anchor-related/USN-4600-1
- anchor-related/USN-6049-1
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/18.04