Home

CVE-2020-7238

Description

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
1.687

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2020-7238,CVE-2019-20445 are fixed in Netty-netty-handler 4.1.45Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.4Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.2Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.3Windows
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 2.3Windows
Asynchronous event-driven network application framework (USN-4600-1) libnetty-3.9-java_3.9.0.Final-1ubuntu0.1_all.debLinux
Vulnerabilities CVE-2020-7238,CVE-2019-20445 are fixed in Netty-netty-handler for Linux 4.1.45Linux
Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) Vulnerability (CVE-2020-7238)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234