Ubuntu Security Notice 4532-1 - It was discovered that Netty incorrectly handled certain HTTP headers. By sending an HTTP header with whitespace before the colon, a remote attacker could possibly use this issue to perform an HTTP request smuggling attack. It was discovered that Netty incorrectly handled certain HTTP headers. By sending an HTTP header that lacks a colon, a remote attacker could possibly use this issue to perform an HTTP request smuggling attack. Various other issues were also addressed.
2f54f490a7d1b2412572a85a25f8724e577ce5e656973f71b6cf173cdf22ca6b
==========================================================================
Ubuntu Security Notice USN-4532-1
September 22, 2020
netty-3.9 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Netty.
Software Description:
- netty-3.9: Asynchronous event-driven network application framework
Details:
It was discovered that Netty incorrectly handled certain HTTP headers.
By sending an HTTP header with whitespace before the colon, a remote
attacker could possibly use this issue to perform an HTTP request
smuggling attack. (CVE-2019-16869)
It was discovered that Netty incorrectly handled certain HTTP headers.
By sending an HTTP header that lacks a colon, a remote attacker could
possibly use this issue to perform an HTTP request smuggling attack.
(CVE-2019-20444)
It was discovered that Netty incorrectly handled certain HTTP headers.
By sending a Content-Length header accompanied by a second
Content-Length header, or by a Transfer-Encoding header, a remote
attacker could possibly use this issue to perform an HTTP request
smuggling attack. (CVE-2019-20445)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libnetty-3.9-java 3.9.9.Final-1+deb9u1build0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4532-1
CVE-2019-16869, CVE-2019-20444, CVE-2019-20445
Package Information:
https://launchpad.net/ubuntu/+source/netty-3.9/3.9.9.Final-1+deb9u1build0.18.04.1