-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 26 Mar 2021 13:37:15 +0100 Source: netty Architecture: source Version: 1:4.1.48-3 Distribution: unstable Urgency: high Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Markus Koschany <apo@debian.org> Closes: 984948 Changes: netty (1:4.1.48-3) unstable; urgency=high . * Team upload. * Fix CVE-2021-21295: There is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. (Closes: #984948) Checksums-Sha1: c60c819be2b80fc6737e322b37b7c3a7d561e883 2590 netty_4.1.48-3.dsc b9388c1a8f1ccc9bf962eee733c24610d2644d17 22828 netty_4.1.48-3.debian.tar.xz 7ab7688bf7d2ce12f4b74af85b3800766b2532d9 14173 netty_4.1.48-3_amd64.buildinfo Checksums-Sha256: 7280cbc653e554cdabf4030bb797d99d40595dcbf0837452e58f06fb8e0308d4 2590 netty_4.1.48-3.dsc 6c46a1aed05693555114fd5b9be81f0a04e2580b8a8b71450b45e48d747b9070 22828 netty_4.1.48-3.debian.tar.xz e41356e1ec44ebd31d2c803b47d612d796a199a6b6f4ba2b21d2d2477acf84c3 14173 netty_4.1.48-3_amd64.buildinfo Files: e69025191209806015b5e044c1fe8b0d 2590 java optional netty_4.1.48-3.dsc b4ae23372fbeb55842b98c37fede59df 22828 java optional netty_4.1.48-3.debian.tar.xz d6e9a9959ef907f5378d5def0eba4749 14173 java optional netty_4.1.48-3_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmBeYJdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp YW4ub3JnAAoJENmtFLlRO1HkG5gQAL1RttTgL5RkrLYGSgbNsSf9JOA+3EzyX0A7 ZsgnB4WAZvuLJn9Wws4ZZUDCRNMFd1Q3ppsa+LrE5O9r5xtgUCS4MtHMqpZ3vz7/ cLeXh6dWUK1P5/Bd3rNEtAwyYefp8xbQBhjS8g0XRQLsDe30UMN2pm2097nL4Cxl 2sc7tbJ+TLbCHtcdVQe0x55ZTdkIwbrFSI9odKU6d2/5n/tCUpxuFkm0gvvfEKlc RwXSSq6QfpOAYwHYPtJK73jE6uaCuezgdJx4XOaGeJjxL0NiSWG/Mc9vTVcydofQ Li+rI2p+38l6Kt09gMeEM6CJZBZuCz2HkmPvyW5ndIGVKB7m/5V+9xQSCbkBYdxw r9e6CDPmj/cQhTo+bR5FGNE+Zp9hlZyCl/yr/UxnW/AvOQrNLExPO8PIuvPDgm+8 kGvaS1urKk7BTMNQ5HH9wTjF2qNUO/V4Bal654f4KruuP4uj26DL18d6b0hHpc7O Ze4poAuIGDceMrK60gSOlJ/dKhxt6QvvSNcL6qjAt7i5RqSJ2rJTOI7gQuuSYwPq T4f4nc0mrxCNAu39EU90CTk+nYaEV5oyOfy6wpYfgXza1S4GcB0vQmI4NHbRcW+B RIlqkZtDBQ58GhLv0wybuymzrnacPe8RFHtBmHeI+j11qu6zNNvbqpFLKQo5N107 UIe2JypS =Uxox -----END PGP SIGNATURE-----
