Bug 1206379 (CVE-2022-41915) - VUL-0: CVE-2022-41915: netty3,netty: HTTP Response splitting from assigning header value iterator
Summary: VUL-0: CVE-2022-41915: netty3,netty: HTTP Response splitting from assigning h...
Status: RESOLVED FIXED
Alias: CVE-2022-41915
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/350434/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-41915:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-13 15:57 UTC by Thomas Leroy
Modified: 2024-05-03 09:24 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2022-12-13 15:57:05 UTC
CVE-2022-41915

Netty project is an event-driven asynchronous network application framework. In
versions prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an
_iterator_ of values, header value validation was not performed, allowing
malicious header values in the iterator to perform HTTP Response Splitting. This
issue has been patched in version 4.1.86.Final. Integrators can work around the
issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call,
into a `remove()` call, and call `add()` in a loop over the iterator of values.

Upstream fix:
https://github.com/netty/netty/commit/fe18adff1c2b333acb135ab779a3b9ba3295a1c4

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41915
https://www.cve.org/CVERecord?id=CVE-2022-41915
https://github.com/netty/netty/security/advisories/GHSA-hh82-3pmq-7frp
Comment 1 Thomas Leroy 2022-12-13 16:19:55 UTC
Affected:
- SUSE:SLE-15-SP2:Update/netty
- SUSE:SLE-15-SP2:Update:Products:Manager41:Update/netty
- SUSE:SLE-15-SP3:Update:Products:Manager42:Update/netty
- SUSE:SLE-15-SP4:Update:Products:Manager43:Update/netty
- openSUSE:Backports:SLE-15-SP3:Update/netty
Comment 5 Maintenance Automation 2023-05-08 09:05:16 UTC
SUSE-SU-2023:2096-1: An update that solves three vulnerabilities and contains one feature can now be installed.

Category: security (important)
Bug References: 1199338, 1206360, 1206379
CVE References: CVE-2022-24823, CVE-2022-41881, CVE-2022-41915
Jira References: SLE-23217
Sources used:
openSUSE Leap 15.4 (src): netty-tcnative-2.0.59-150200.3.10.1, netty-4.1.90-150200.4.14.1
Development Tools Module 15-SP4 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise Real Time 15 SP3 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Enterprise Storage 7.1 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Enterprise Storage 7 (src): netty-tcnative-2.0.59-150200.3.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Maintenance Automation 2023-06-21 12:31:47 UTC
SUSE-SU-2023:2096-2: An update that solves three vulnerabilities and contains one feature can now be installed.

Category: security (important)
Bug References: 1199338, 1206360, 1206379
CVE References: CVE-2022-24823, CVE-2022-41881, CVE-2022-41915
Jira References: SLE-23217
Sources used:
openSUSE Leap 15.5 (src): netty-tcnative-2.0.59-150200.3.10.1, netty-4.1.90-150200.4.14.1
Development Tools Module 15-SP5 (src): netty-tcnative-2.0.59-150200.3.10.1
SUSE Package Hub 15 15-SP5 (src): netty-4.1.90-150200.4.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Fridrich Strba 2024-03-04 12:27:58 UTC
Fixed. Time to close it.
Comment 8 Robert Frohl 2024-05-03 09:24:16 UTC
done, closing