CVE-2019-16869: Netty HTTP request smuggling via header whitespace mishandling

Quick answers

Is CVE-2019-16869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-16869 being exploited in the wild.

How severe is CVE-2019-16869?

High severity, with a CVSS score of 7.5, published 11 October 2019.

Which products and versions are affected?

io.netty:netty (Maven) >= 3.3.0.Final, <= 4.0.0.Alpha8, ECOSYSTEM:introduced=3.3.0.Final,last_affected=4.0.0.Alpha8; io.netty:netty-all (Maven) >= 4.0.0.Beta1, < 4.1.42.Final, ECOSYSTEM:introduced=4.0.0.Beta1,fixed=4.1.42.Final; org.jboss.netty:netty (Maven) <= 3.2.9.Final, ECOSYSTEM:introduced=0,last_affected=3.2.9.Final; Netty >= 4.0.0.Beta1, < 4.1.42.Final.

Is there a fix for CVE-2019-16869?

Yes. io.netty:netty-all (Maven): upgrade to 4.1.42.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-16869 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-16869?

Check whether you run io.netty:netty (Maven), io.netty:netty-all (Maven), org.jboss.netty:netty (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• io.netty:netty-all (Maven): upgrade to 4.1.42.Final or later

  # set io.netty:netty-all to 4.1.42.Final in your pom.xml or build.gradle

Technical details

A request smuggling vulnerability exists in Netty due to improper parsing of HTTP headers. Specifically, the framework mishandles whitespace characters preceding the colon in header fields (e.g., 'Transfer-Encoding : chunked'). This discrepancy in header parsing between Netty and other downstream proxies or servers allows an attacker to craft malicious requests that are interpreted differently by different components in the request chain. An unauthenticated remote attacker can exploit this to bypass security constraints or poison web caches. The issue is resolved in Netty version 4.1.42.Final.

Affected products

• Netty netty-all >= 4.0.0.Beta1, < 4.1.42.Final
• Netty netty >= 3.3.0.Final, <= 4.0.0.Alpha8
• JBoss netty <= 3.2.9.Final

Identifiers

• CVE-2019-16869
• GHSA-p979-4mfw-53vg

Timeline

• 2019-10-11: advisory: GitHub Advisory published
• 2019-10-11: disclosed: NVD publication date
• 2019-09-26: patched: Netty 4.1.42.Final released

References

• https://api.github.com/users/G-Rath
• https://github.com/G-Rath
• https://api.github.com/users/G-Rath/gists%7B/gist_id%7D
• https://api.github.com/users/G-Rath/repos
• https://avatars.githubusercontent.com/u/3151613?v=4
• https://api.github.com/users/G-Rath/events%7B/privacy%7D