CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be…

Description

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)8.9% · higher than 95% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DL

Debian Linux · Debian

8.0; 9.0; 10.0 · source: NVD

FE

Fedora · Fedoraproject

33 · source: NVD

JA

Jboss Amq Clients · Redhat

2 · source: NVD

JE

Jboss Enterprise Application Platform · Redhat

7.2; 7.3 · source: NVD

NE

Netty · Netty

before 4.1.44 · source: NVD

UL

Ubuntu Linux · Canonical

18.04 · source: NVD