[GHSA-p979-4mfw-53vg] HTTP Request Smuggling in Netty

[SunBK201]

Updates

• Affected products

Comments
According to Patch, vulnerability function did not exist before 4.0.0.Alpha1, and I have verified that this vulnerability could not be triggered before 4.0.0.Alpha1.

[CallmeMari]

@SunBK201 do you have any references to support the changes to affected version(s) and affected products?

[SunBK201]

References
https://sca.analysiscenter.veracode.com/vulnerability-database/security/http-request-smuggling/java/sid-21582/summary

[darakian]

Hey @SunBK201, sorry for the delay on this one but any chance you can elaborate on

and I have verified that this vulnerability could not be triggered before 4.0.0.Alpha1.

Do you have a minimal poc you can share or is do you know the commit/PR where the vuln was introduced? I don't see where in that patch it says that the vuln was introduced in 4.0.0.Alpha1

[SunBK201]

According to 4.0.0.Alpha1, the vulnerability function splitHeader still exists.

[darakian]

Ah, I see. 4.0.0.Alpha1 is the first version of the artifact under that name.
netty/netty@7518e98

[advisory-database]

Hi @SunBK201! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!