Input validation error in Netty
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2015-2156 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Netty Universal components / Libraries / Libraries used by multiple products Play Framework Web applications / Modules and components for CMS |
| Vendor |
Netty project Jenkins |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Input validation error
EUVDB-ID: #VU38060
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2015-2156
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
MitigationInstall update from vendor's website.
Vulnerable software versionsNetty: 3.10.0 - 4.1.0
Play Framework: 2.0 - 4.1.0
External linkshttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html
http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
http://www.openwall.com/lists/oss-security/2015/05/17/1
http://www.securityfocus.com/bid/74704
http://bugzilla.redhat.com/show_bug.cgi?id=1222923
http://github.com/netty/netty/pull/3754
http://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
http://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3@%3Ccommits.cassandra.apache.org%3E
http://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769@%3Ccommits.cassandra.apache.org%3E
http://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
http://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
