swagger-api / swagger-api/swagger-codegen
CVE-2020-7238 (High) detected in netty-codec-http-4.1.8.Final.jar, netty-codec-http-4.0.42.Final.jar
Nobody has claimed this yet.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
CVE-2020-7238 - High Severity Vulnerability
Vulnerable Libraries - netty-codec-http-4.1.8.Final.jar, netty-codec-http-4.0.42.Final.jar
netty-codec-http-4.1.8.Final.jar
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: http://netty.io/
Path to dependency file: /samples/client/petstore/java/vertx/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.netty/netty-codec-http/4.1.8.Final/1e88617c4a6c88da7e86fdbbd9494d22a250c879/netty-codec-http-4.1.8.Final.jar
Dependency Hierarchy:
- vertx-web-client-3.4.2.jar (Root Library)
- vertx-core-3.4.2.jar
- ❌ netty-codec-http-4.1.8.Final.jar (Vulnerable Library)
- vertx-core-3.4.2.jar
netty-codec-http-4.0.42.Final.jar
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: http://netty.io/
Path to dependency file: /samples/client/petstore/java/retrofit2-play25/build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/io.netty/netty-codec-http/4.0.42.Final/70a96479b6f4110d5f4a4003413e5bf758393e5f/netty-codec-http-4.0.42.Final.jar
Dependency Hierarchy:
- play-java-ws_2.11-2.5.14.jar (Root Library)
- async-http-client-2.0.24.jar
- ❌ netty-codec-http-4.0.42.Final.jar (Vulnerable Library)
- async-http-client-2.0.24.jar
Found in HEAD commit: 4b7a8d7d7384aa6a27d6309c35ade0916edae7ed
Found in base branches: 3.0.0, master
Vulnerability Details
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Publish Date: 2020-01-27
URL: CVE-2020-7238
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2020-01-27
Fix Resolution (io.netty:netty-codec-http): 4.1.44.Final
Direct dependency fix Resolution (io.vertx:vertx-web-client): 3.5.0
- Check this box to open an automated fix PR
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with samples/client/petstore/java/vertx/build.gradle and samples/client/petstore/java/retrofit2-play25/build.gradle, then inspect how their transitive Netty dependencies are resolved. Update the dependency path to a release that includes the stated fix and verify both samples build with no vulnerable netty-codec-http versions remaining.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100