CVE-2020-7238 (High, reachable) detected in netty-codec-http-4.1.13.Final.jar - autoclosed

[mend-local-app[bot]]

CVE-2020-7238 - High Severity Vulnerability

Vulnerable Library - netty-codec-http-4.1.13.Final.jar

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Library home page: http://netty.io/

Path to dependency file: /pom.xml

Path to vulnerable library: /Users/alexmaybaum/.m2/repository/io/netty/netty-codec-http/4.1.13.Final/netty-codec-http-4.1.13.Final.jar

Dependency Hierarchy: - transport-5.6.4.jar (Root Library) - transport-netty4-client-5.6.4.jar - :x: **netty-codec-http-4.1.13.Final.jar** (Vulnerable Library)

Found in HEAD commit: 9c6901108cf0138889fa46846fabfcb78828d070

Found in base branch: vp-rem

Reachability Analysis(Reachable)

This vulnerability is potentially used ``` com.visualpathit.account.utils.ElasticsearchUtil (Application) -> org.elasticsearch.transport.client.PreBuiltTransportClient (Extension) -> org.elasticsearch.transport.Netty4Plugin (Extension) -> org.elasticsearch.http.netty4.Netty4HttpServerTransport (Extension) -> org.elasticsearch.http.netty4.Netty4HttpServerTransport$HttpChannelHandler (Extension) -> io.netty.handler.codec.http.HttpRequestDecoder (Extension) -> ❌ io.netty.handler.codec.http.HttpObjectDecoder (Vulnerable Component) ```

Vulnerability Details

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Publish Date: 2020-01-27

URL: CVE-2020-7238

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-27

Fix Resolution: io.netty:netty-all:4.1.44.Final;io.netty:netty-codec-http:4.1.44.Final

[mend-local-app[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.