Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2022-41915
Good to know:
Date: December 12, 2022
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling "DefaultHttpHeadesr.set" with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the "DefaultHttpHeaders.set(CharSequence, Iterator<?>)" call, into a "remove()" call, and call "add()" in a loop over the iterator of values. After conducting further research, Mend has determined that versions 4.1.80.Final up to and including 4.1.85.Final of netty-codec-http are vulnerable to CVE-2022-41915.
Language: Java
Severity Score
Related Resources (13)
Severity Score
Weakness Type (CWE)
Top Fix
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | LOW |
| Integrity (I): | LOW |
| Availability (A): | NONE |