CVE-2022-41915

Katalog CVE

CVSS 6.5 · Medium EPSS 0,95%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada netty, debian linux. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.

Rincian

Terbit di NVD

13 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-436: Interpretation Conflict

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4 patch · advisory pihak ketiga
• https://github.com/netty/netty/pull/12760 patch · advisory pihak ketiga
• https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp mitigasi · advisory pihak ketiga
• https://github.com/netty/netty/issues/13084 exploit · issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/01/msg00008.html mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230113-0004/ advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5316 advisory pihak ketiga