Netty 漏洞,建议大家升级netty至 4.1.42.Final版本

Netty 漏洞,建议大家升级netty至 4.1.42.Final版本

近日Netty 4.x版本爆出了CVE-2019-16869漏洞.详情见这里:4.1.42.Final版本即可.具体的行为如下:request smuggling, cause by obfuscating TE header`Expected behaviorignore obfuscating TE header("Transfer-Encoding : chunked" vs "Transfer-Encoding: chunked")

Actual behavioruse Transfer-Encoding[space] as Transfer-Encoding

Steps to reproduce1、topology: client→elb→nettyServer2、client send a request with both content-length and trunked-encoded[space]3、elb ignored trunked-encoded[space], but use content-length4、netty use trunked-encoded[space]

Minimal yet complete reproducer code (or URL to code)when header field end with space but not colon, shoud the space be ignored?can not found proof in in io.netty.handler.codec.(nameEnd = nameStart; nameEnd < length; nameEnd ++) {char ch = sb.charAt(nameEnd);if (ch == ':' || Character.isWhitespace(ch)) {break;}}Netty versionall

JVM version (e.g. java -version)OS version (e.g. uname -a)`

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。