CVE - CVE-2022-41915

CVE-ID
CVE-2022-41915	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20230113-0004/ CONFIRM:https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp URL:https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp DEBIAN:DSA-5316 URL:https://www.debian.org/security/2023/dsa-5316 MISC:https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4 URL:https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4 MISC:https://github.com/netty/netty/issues/13084 URL:https://github.com/netty/netty/issues/13084 MISC:https://github.com/netty/netty/pull/12760 URL:https://github.com/netty/netty/pull/12760 MLIST:[debian-lts-announce] 20230111 [SECURITY] [DLA 3268-1] netty security update URL:https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20220930	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220930)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)