Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3055
netty-3.9 security update
7 September 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: netty-3.9
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-20445 CVE-2019-20444 CVE-2019-16869
Reference: ESB-2020.3049
ESB-2020.0583
ESB-2020.0582
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2365-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Roberto C. S=E1nchez
September 04, 2020 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : netty-3.9
Version : 3.9.9.Final-1+deb9u1
CVE ID : CVE-2019-16869 CVE-2019-20444 CVE-2019-20445
Debian Bug : 941266 950966 950967
Several vulnerabilities have been discovered in netty-3.9, a Java NIO
client/server socket framework.
CVE-2019-16869
Netty before 4.1.42.Final mishandles whitespace before the colon in
HTTP headers (such as a "Transfer-Encoding : chunked" line), which
leads to HTTP request smuggling.
CVE-2019-20444
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header
that lacks a colon, which might be interpreted as a separate header
with an incorrect syntax, or might be interpreted as an "invalid
fold."
CVE-2019-20445
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length
header to be accompanied by a second Content-Length header, or by a
Transfer-Encoding header.
For Debian 9 stretch, these problems have been fixed in version
3.9.9.Final-1+deb9u1.
We recommend that you upgrade your netty-3.9 packages.
For the detailed security status of netty-3.9 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/netty-3.9
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEz9ERzDttUsU/BH8iLNd4Xt2nsg8FAl9SikAACgkQLNd4Xt2n
sg8uGg/+MmmZWo5Qgly8dESIrY6aAg0DdAAHdgyM8IjIqeI9pGzVbnGfrlrN3R2z
jHxMviBmUfJBAUtOeA/sU1Tog5vLn900G6BW84/wWG7cMej/4Hj29qFf+7iiYNBE
ySAsI0aHG/hjf393jWXOGcXZPJiaLZJnOynNyHRD/DiL8oD74ri+z4tLm470Pit1
C+tpL4hpIly6IFCtPQwfSfULQcwAH4WNybWaD87GwwJpJGaR8UVhF7ObYh6n9AXA
Xp6nr7k4Q+a4wp+KAcsTemuA1Kx4QBbiR4scdEeYbK1O9Ldep5bo1iUmFJshVNTQ
WmvUGj5xSTHjoc+LT/a+FocV0eBXfBs8k+lo0hBo0GPjmgHVcCL38416+jePmxS5
EZXXV/7zwTWqkOy1r4/48HYR+1PjJ4zita/abtQhSt4+htA20qnkwemnL6k5qTSg
tTFsVpYRIuv4E5q4Z42QbVZPjaTcgBH7GOJRuCvEcaKfhuMN4Z0ZHBqJstN/ceZW
7EgFPXV3ZROzNQJC82Khf0eAu9X48C1ic7V0gtgKCaNwl5Eknc73HvunqYCl2Gqs
NqJsaYXlUfAveexTAVCNa/L721d4hKjlR9HrWnBVC6cwm7XMabP8xb4kDns5h7Cs
ZZxzSX9x5SPHSMH+85tCN6DgfTqX1IxeeliLkfHADjLgKYl0uKI=
=JjGG
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX1W33+NLKJtyKPYoAQgZOA/+K4ITK+tFuIllcpieyfEkjUP7azKBNRjY
5ZH0w4HNkaZNUEt4FeQzvuc8SJZXbj01jberM8JnBCm7Qnd49P+7xo1wD48Q5vzg
eS+meRhNwZRmv3w/Z55j+XLX7Cg8LtzRaFTwQRDN/zdPXsu+e1VE5nX7ApGD/mWV
1Bexh3AuqKDWlpyAvcTfKSkoalVes1V4WKk34gAiTuZN1IIQTXbijBFT+VO1pA4L
QrD8KGgUDN3uAmacSdMiV2UGx5qerjQZ18f4dnTpCb3vl/XkEKTtB6KYk04JZmf2
5eRE+5J5AW6gwa4UZ0oZyeVQSN2SZdsPHJ1r9sww4BeU9B+uqfgSWTrURUgxloZB
sVU0YsmY3sSd96dXzreA5BLZrTTyIOAVZDGxQ4DlgdQCOe7HpljticZPRbuMI0lf
8T0M+eu5vZPR2IZs2bwydqmACHxJm4Z7i5AwmoVzbzyocwGfXpzPWO/MMWHXD5Jy
xEgD07UBikGDxn/3Tb3842GENplEXzQIRcJh/3e01MVtCdWbmU41JLKoZjmCr6OY
frSRaxqi4GnAyRCnNiQKL0wVSmMXlIixN6bUkMYPHSnmSOVSjsliB8bxPqLgmpeY
fLErSeY6LaG5ZiAYDuns1JVqLwazvSb+LJVv1qDGKnMiaG4O0xL0YwXOVk6qUesv
1UTeOomgXNI=
=go8L
-----END PGP SIGNATURE-----