Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.jooby:jooby-netty

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

    CVE-2020-7622 · GHSA-gv3v-92v6-m48j

    Affected
    • Maven io.jooby:jooby-netty < 2.2.1
    Fixed in
    2.2.1· Vendor fix available
    Issue
    Impact - Cross Site Scripting - Cache Poisoning - Page Hijacking Patches This was fixed in version 2.2.1. Workarounds If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters. References CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability. Root Cause This roots cause back to this line in the Jooby codebase: https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102 The DefaultHttpHeaders takes a parameter validate which, when true (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting. Reported By This vulnerability was reported by @JLLeitschuh (Twitter)…

    Recommended action: Upgrade to 2.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →