NetSight
IP …
critical9.1

CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding hea…

Impact

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Affected products

VendorProductAffected versions
NettyNetty
before 4.1.44
DebianDebian Linux
Versions 8.0, 9.0, 10.0
FedoraprojectFedora
Version 33
CanonicalUbuntu Linux
Version 18.04
RedhatJboss Amq Clients
Version 2
RedhatJboss Enterprise Application Platform
Versions 7.2, 7.3
ApacheSpark
Versions 2.4.7, 2.4.8

Weakness classification

CWE-444

References