ExploitCVE-2022-41915
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') (CWE-113)
Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator )` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Timeline
Feedly found the first article mentioning CVE-2022-41915. See article
CVE-2022-41915 is a vulnerability in Netty that can lead to denial of service and response splitting, impacting the Operations Dashboard. The criticality of this vulnerability is underscored by its potential to disrupt services, although specific CVSS scores, exploitation details, and available mitigations or patches are not provided in the given information. Additionally, there is no mention of proof-of-concept exploits or downstream impacts on third-party vendors or technologies. See article
EPSS Score was set to: 0.07% (Percentile: 27.1%)
Detection for the vulnerability has been added to Nessus (202724)