Improper Neutralization of CRLF Sequences in HTTP Headers in Versions of Armeria 0.85.0 through and including 0.96.0

Overview :
Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.
Affected Product(s) :
  • Versions of Armeria 0.85.0 through and including 0.96.0
Vulnerability Details :
CVE ID : CVE-2019-16771

Impact

  1. Cross-User Defacement
  2. Cache Poisoning
  3. Cross-Site Scripting (XSS)
  4. Page Hijacking

Root Cause

The root cause is due to the usage of Netty without the HTTP header validation.

Remediation / Fixes :

This vulnerability has been patched in 0.97.0.

Common Vulnerabilityies and Exposures

Contact us to get started

CVE-2022-AVAST2 : Self-Defense Bypass via Repairing Function

Description It was noted that there is security checking to prevent some of the Avast processes from loading of undesired/unsigned

CVE-2022-21500 : Oracle Security Alert Advisory

Description This Security Alert addresses vulnerability CVE-2022-21500, which affects some deployments of Oracle E-Business Suite. This vulnerability is remotely exploitable

CVE-2022-1183 : Destroying a TLS session early causes assertion failure

Description On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those