Inconsistent interpretation of HTTP requests in Netty - CVE-2019-16869

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU22825

Inconsistent interpretation of HTTP requests in Netty - CVE-2019-16869

Published: November 18, 2019 / Updated: February 11, 2025


Vulnerability identifier: #VU22825
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16869
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP request smuggling attack.

The vulnerability exists due to improper input validation when processing a whitespace before the colon in HTTP headers (e.g. "Transfer-Encoding : chunked"). A remote attacker can send a specially crafted HTTP request and perform HTTP request smuggling attack.


Affected software

Netty
IBM Observability with Instana
IBM PureData System for Operational Analytics
Log Analysis
IBM Cloud Transformation Advisor
Autodesk Infraworks
IBM Watson Knowledge Catalog in Cloud Pak for Data
HPE Telco IP Mediation E-Media
IBM Spectrum Protect Plus
Debian Linux
Ubuntu
openEuler
Planning Analytics Local
Security QRadar EDR
Dell Support Assist Enterprise
Dell EMC PowerStore Family Operating System
IBM Sterling Order Management
AMQ Broker
Fuse
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
Red Hat Openshift Application Runtimes
Cloud Pak for Security (CP4S)
watsonx.data
libnetty-3.9-java (Ubuntu package)
netty3
netty (Debian package)
libnetty-java (Ubuntu package)
Red Hat Single Sign-On

How to mitigate CVE-2019-16869

Install updates from vendor's website.

Netty - update to 4.1.42
Log Analysis - update to 1.3.8
Planning Analytics Local - update to 2.0.1
IBM Cloud Transformation Advisor - update to 3.2.1
Security QRadar EDR - update to 3.12.15
Dell Support Assist Enterprise - update to 4.00.06.00
AMQ Broker - addressed in versions 7.4.3, 7.6
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.8.0
Fuse - update to 7.5.0
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
Dell EMC PowerStore Family Operating System - update to 1.0.4.0.5.003
Cloud Pak for Security (CP4S) - update to 1.10.12.0
watsonx.data - addressed in versions 2.0.2, 2.0.3
libnetty-3.9-java (Ubuntu package) - addressed in versions 3.9.0.Final-1ubuntu0.1, 3.9.9.Final-1+deb9u1build0.18.04.1
netty3 - update to 3.10.6-8
netty (Debian package) - addressed in versions 1:4.1.7-2+deb9u1, 1:4.1.33-1+deb10u1
libnetty-java (Ubuntu package) - update to 1:4.1.7-4ubuntu0.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.8.0
Red Hat Single Sign-On - update to 7.3.6
RSA Authentication Manager - update to 8.4 Patch 11
HPE Telco IP Mediation E-Media - update to 8.5.1
IBM Sterling Order Management - update to 10.0.0.29
IBM Spectrum Protect Plus - update to 10.1.6.4

External References

Related Security Bulletins