HTTP response splitting in Netty - CVE-2022-41915

Vulnerability identifier: #VU70119

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-41915

CWE-ID: CWE-113

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not validate header values when calling DefaultHttpHeaders.set with an iterator of values. A remote attacker can inject arbitrary header values and perform HTTP splitting attacks.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Netty
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
DataStage on Cloud Pak for Data
Db2 Graph
DataPower Operations Dashboard
IBM Planning Analytics Workspace
MaaS360 Configuration Utility
IBM MaaS360 Base Module
MaaS360 PKI Certificate Module
PowerStore T
IBM QRadar Incident Forensics
Dell Data Protection Central
IBM Process Mining
IBM SPSS Analytic Server
IBM Watson Discovery for IBM Cloud Pak for Data
Netcool Operations Insight
IBM MaaS360 Mobile Enterprise Gateway
IBM MaaS360 Cloud Extender Agent
IBM Watson Assistant for IBM Cloud Pak for Data
UCD - IBM UrbanCode Deploy
IBM Maximo Asset Management
IBM Maximo Application Suite
Operations Dashboard
IBM Cloud Pak for Multicloud Management
IBM Disconnected Log Collector
SecureTransport
Oracle Communications Pricing Design Center
libnetty-java (Ubuntu package)
netty-tcnative-javadoc
netty-tcnative
netty (Debian package)
netty-poms
netty-javadoc
netty
Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1
Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1
Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1
Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1
Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1
Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1
Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1
Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1
Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1
Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1
Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1
Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1
Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1
Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1
IBM MaaS360 VPN Module
IBM Qradar SIEM
IBM Security Verify Access

Install updates from vendor's website.

Netty - update to 4.1.86
IBM Process Mining - update to 1.14.0.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
DataStage on Cloud Pak for Data - update to 4.8.5
SecureTransport - update to 5.5-20230126
libnetty-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1:4.1.48-4+deb11u1build0.22.04.1, 1:4.1.48-5ubuntu0.1
Db2 Graph - addressed in versions 1.0.0.1562-amd64, 1.0.0.1562-s390x, 1.0.0.1562-ppcle, 1.0.0.1598-amd64, 1.0.0.1598-s390x, 1.0.0.1598-ppcle
DataPower Operations Dashboard - update to 1.0.19.0
Netcool Operations Insight - update to 1.6.10
IBM Disconnected Log Collector - update to 1.8.3
netty-tcnative-javadoc - update to 2.0.59-150200.3.10.1
netty-tcnative - update to 2.0.59-150200.3.10.1
IBM Planning Analytics Workspace - update to 2.0.83
MaaS360 Configuration Utility - update to 3.000.100
IBM MaaS360 Base Module - update to 3.000.100
MaaS360 PKI Certificate Module - update to 3.000.100
IBM MaaS360 VPN Module - update to 3.000.100
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.100
IBM MaaS360 Cloud Extender Agent - update to 3.000.100.069
PowerStore T - update to 3.5.0.1-2083289
netty (Debian package) - update to 1:4.1.48-4+deb11u1
netty-poms - update to 4.1.90-150200.4.14.1
netty-javadoc - update to 4.1.90-150200.4.14.1
netty - update to 4.1.90-150200.4.14.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.6.2
UCD - IBM UrbanCode Deploy - addressed in versions 6.2.7.20, 7.0.5.15, 7.1.2.11, 7.2.3.4, 7.3.1.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
IBM Maximo Asset Management - update to 7.6.1.3.16
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
IBM Security Verify Access - update to 10.0.7.0
Dell Data Protection Central - update to 19.11.0-2
Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1 - update to 76-Final.html
Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1 - update to 77-Final.html
Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1 - update to 78-Final.html
Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1 - update to 79-Final.html
Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1 - update to 80-Final.html
Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1 - update to 81-Final.html
Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1 - update to 82-Final.html
Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1 - update to 84-Final.html
Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1 - update to 85-Final.html
Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1 - update to 86-Final.html
Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1 - update to 87-Final.html
Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1 - update to 88-Final.html
Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1 - update to 89-Final.html
Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1 - update to 90-Final.html
Operations Dashboard - update to 2022.2.1-8-lts

• https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp

• Multiple vulnerabilities in Netty
• Debian update for netty
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• HTTP response splitting in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Operations Dashboard
• HTTP response splitting in IBM UrbanCode Deploy (UCD)
• Multiple vulnerabilities in Axway SecureTransport (January 2023)
• Multiple vulnerabilities in IBM DataPower Operations Dashboard
• Ubuntu update for netty
• IBM Watson Discovery Cartridge for IBM Cloud Pak for Data update for Netty
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in IBM Db2 Graph
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender Agent, Mobile Enterprise Gateway, Configuration Utility, VPN, Certificate and Base Module
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• HTTP response splitting in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in Dell Data Protection Central
• IBM SPSS Analytic Server update for Netty
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data