CVE-2015-2156 Information Exposure in Netty
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| io.netty/netty-parent(Maven) | >= 4.0.0, < 4.0.28.Final | 4.0.28.Final |
| org.jboss.netty/netty(Maven) | < 3.9.8.Final | 3.9.8.Final |
| org.jboss.netty/netty(Maven) | >= 3.10.0, < 3.10.3.Final | 3.10.3.Final |
| io.netty/netty(Maven) | >= 3.10.0, < 3.10.3.Final | 3.10.3.Final |
| io.netty/netty(Maven) | < 3.9.8.Final | 3.9.8.Final |
| io.netty/netty-parent(Maven) | = 4.0.0.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.1.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.10.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.11.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.12.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.13.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.14.Beta1 | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.14.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.15.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.16.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.17.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.18.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.19.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.2.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.20.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.21.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.22.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.23.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.24.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.25.Final | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| io.netty/netty-parent(Maven) | = 4.0.26.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.27.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.3.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.4.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.5.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.6.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.7.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.8.Final | No fix listed |
| io.netty/netty-parent(Maven) | = 4.0.9.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.0.CR1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.0.CR2 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.0.CR3 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.0.CR4 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.0.CR5 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.0.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.1.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.0.2.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.ALPHA1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.ALPHA2 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.ALPHA3 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.ALPHA4 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.BETA1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.BETA2 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.BETA3 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.CR1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.0.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.1.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.2.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.3.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.4.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.1.5.GA | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.ALPHA1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.ALPHA2 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.ALPHA3 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.ALPHA4 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.BETA1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.CR1 | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.0.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.1.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.10.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.2.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.3.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.4.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.5.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.6.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.7.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.8.Final | No fix listed |
| org.jboss.netty/netty(Maven) | = 3.2.9.Final | No fix listed |
| io.netty/netty(Maven) | = 3.10.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.10.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.10.2.Final | No fix listed |
| io.netty/netty(Maven) | = 3.3.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.3.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.0.Alpha1 | No fix listed |
| io.netty/netty(Maven) | = 3.4.0.Alpha2 | No fix listed |
| io.netty/netty(Maven) | = 3.4.0.Beta1 | No fix listed |
| io.netty/netty(Maven) | = 3.4.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.2.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.3.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.4.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.5.Final | No fix listed |
| io.netty/netty(Maven) | = 3.4.6.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.0.Beta1 | No fix listed |
| io.netty/netty(Maven) | = 3.5.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.10.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.11.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.12.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.13.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.2.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.3.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.4.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.5.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.6.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.7.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.8.Final | No fix listed |
| io.netty/netty(Maven) | = 3.5.9.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.0.Beta1 | No fix listed |
| io.netty/netty(Maven) | = 3.6.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.10.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.2.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.3.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.4.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.5.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.6.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.7.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.8.Final | No fix listed |
| io.netty/netty(Maven) | = 3.6.9.Final | No fix listed |
| io.netty/netty(Maven) | = 3.7.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.7.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.8.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.8.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.8.2.Final | No fix listed |
| io.netty/netty(Maven) | = 3.8.3.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.0.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.1.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.1.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.2.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.3.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.4.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.5.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.6.Final | No fix listed |
| io.netty/netty(Maven) | = 3.9.7.Final | No fix listed |
| debian/netty(Debian:12) | < 1:4.0.31-1 | 1:4.0.31-1 |
| debian/netty(Debian:13) | < 1:4.0.31-1 | 1:4.0.31-1 |
| debian/netty(Debian:14) | < 1:4.0.31-1 | 1:4.0.31-1 |
| netty | <= 3.9.7 | No fix listed |
| netty | = 3.10.0 | No fix listed |
| netty | = 3.10.1 | No fix listed |
| netty | = 3.10.2 | No fix listed |
| netty | = 4.0.0 | No fix listed |
| netty | = 4.0.1 | No fix listed |
| netty | = 4.0.2 | No fix listed |
| netty | = 4.0.3 | No fix listed |
| netty | = 4.0.4 | No fix listed |
| netty | = 4.0.5 | No fix listed |
| netty | = 4.0.6 | No fix listed |
| netty | = 4.0.7 | No fix listed |
| netty | = 4.0.8 | No fix listed |
| netty | = 4.0.9 | No fix listed |
| netty | = 4.0.10 | No fix listed |
| netty | = 4.0.11 | No fix listed |
| netty | = 4.0.12 | No fix listed |
| netty | = 4.0.13 | No fix listed |
| netty | = 4.0.14 | No fix listed |
| netty | = 4.0.15 | No fix listed |
| netty | = 4.0.16 | No fix listed |
| netty | = 4.0.17 | No fix listed |
| netty | = 4.0.18 | No fix listed |
| netty | = 4.0.19 | No fix listed |
| netty | = 4.0.20 | No fix listed |
| netty | = 4.0.21 | No fix listed |
| netty | = 4.0.22 | No fix listed |
| netty | = 4.0.23 | No fix listed |
| netty | = 4.0.24 | No fix listed |
| netty | = 4.0.25 | No fix listed |
| netty | = 4.0.26 | No fix listed |
| netty | = 4.0.27 | No fix listed |
| netty | = 4.1.0-beta1 | No fix listed |
| netty | = 4.1.0-beta2 | No fix listed |
| netty | = 4.1.0-beta3 | No fix listed |
| netty | = 4.1.0-beta4 | No fix listed |
| lightbend play framework | = 2.0-rc3 | No fix listed |
| lightbend play framework | = 2.0-rc4 | No fix listed |
| lightbend play framework | = 2.0-rc5 | No fix listed |
| lightbend play framework | = 2.0.2 | No fix listed |
| lightbend play framework | = 2.0.2-rc1 | No fix listed |
| lightbend play framework | = 2.0.2-rc2 | No fix listed |
| lightbend play framework | = 2.0.3 | No fix listed |
| lightbend play framework | = 2.0.3-rc1 | No fix listed |
| lightbend play framework | = 2.0.3-rc2 | No fix listed |
| lightbend play framework | = 2.0.4 | No fix listed |
| lightbend play framework | = 2.0.4-rc1 | No fix listed |
| lightbend play framework | = 2.0.4-rc2 | No fix listed |
| lightbend play framework | = 2.0.5 | No fix listed |
| lightbend play framework | = 2.0.5-rc1 | No fix listed |
| lightbend play framework | = 2.0.5-rc2 | No fix listed |
| lightbend play framework | = 2.0.6 | No fix listed |
| lightbend play framework | = 2.0.7 | No fix listed |
| lightbend play framework | = 2.0.8 | No fix listed |
| lightbend play framework | = 2.1.0 | No fix listed |
| lightbend play framework | = 2.1.1 | No fix listed |
| lightbend play framework | = 2.1.1-rc1 | No fix listed |
| lightbend play framework | = 2.2.0 | No fix listed |
| lightbend play framework | = 2.2.1 | No fix listed |
| lightbend play framework | = 2.2.2 | No fix listed |
| lightbend play framework | = 2.2.6 | No fix listed |
| lightbend play framework | = 2.3.0 | No fix listed |
| lightbend play framework | = 2.3.0-rc1 | No fix listed |
| lightbend play framework | = 2.3.0-rc2 | No fix listed |
| lightbend play framework | = 2.3.1 | No fix listed |
| lightbend play framework | = 2.3.2 | No fix listed |
| lightbend play framework | = 2.3.2-rc1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch third-party-advisory
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking third-party-advisory
- lists.apache.org
- lists.apache.org
- lists.apache.org
- lists.apache.org
- snyk.io
- www.playframework.com third-party-advisory
- FEDORA-2015-8713 third-party-advisory vendor-advisory
- FEDORA-2015-8684 third-party-advisory vendor-advisory
- netty.io vendor-advisory
- [oss-security] 20150516 Netty/Play's Security Updates (CVE-2015-2156) mailing-list third-party-advisory
- 74704 third-party-advisory vdb-entry
- github.com
- github.com product
- Debian Security Tracker CVE-2015-2156 vendor-advisory
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15423) CVE-2015-2156 (Netty is vulnerable to Information Disclosure) mailing-list
- [cassandra-commits] 20191114 [jira] [Commented] (CASSANDRA-15423) CVE-2015-2156 (Netty is vulnerable to Information Disclosure) mailing-list
- [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 mailing-list
- bugs.debian.org issue-tracking