Debian Bug report logs -
#950966
netty: CVE-2019-20444
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>:
Bug#950966; Package src:netty.
(Sat, 08 Feb 2020 20:33:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>.
(Sat, 08 Feb 2020 20:33:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: netty
Version: 1:4.1.33-3
Severity: grave
Tags: security upstream
Forwarded: https://github.com/netty/netty/issues/9866
Hi,
The following vulnerability was published for netty.
CVE-2019-20444[0]:
| HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header
| that lacks a colon, which might be interpreted as a separate header
| with an incorrect syntax, or might be interpreted as an "invalid
| fold."
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2019-20444
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20444
[1] https://github.com/netty/netty/issues/9866
[2] https://github.com/netty/netty/commit/a7c18d44b46e02dadfe3da225a06e5091f5f328e
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Sun Feb 9 06:23:20 2020;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon