Register | Log in

netty

Java NIO client/server socket framework

Choose email to subscribe with

general

source: netty (main)
version: 1:4.1.33-3
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Kyo Lee [DMD] – Chris Grzegorczyk [DMD] – Graziano Obertelli [DMD]
arch: all
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:3.2.6.Final-2
o-o-sec: 1:3.2.6.Final-2+deb8u1
oldstable: 1:4.1.7-2+deb9u1
old-sec: 1:4.1.7-2+deb9u1
stable: 1:4.1.33-1+deb10u1
stable-sec: 1:4.1.33-1+deb10u1
testing: 1:4.1.33-3
unstable: 1:4.1.33-3

versioned links

1:3.2.6.Final-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:3.2.6.Final-2+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.7-2+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.33-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:4.1.33-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnetty-java

action needed

A new upstream version is available: 4.1.45 high

A new upstream version 4.1.45 is available, you should consider packaging it.

Created: 2019-03-12 Last update: 2020-02-17 12:35

3 security issues in buster high

There are 3 open security issues in buster.

3 important issues:

CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Please fix them.

Created: 2020-01-30 Last update: 2020-02-08 23:02

3 security issues in bullseye high

There are 3 open security issues in bullseye.

3 important issues:

CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Please fix them.

Created: 2020-01-30 Last update: 2020-02-08 23:02

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Please fix them.

Created: 2020-01-30 Last update: 2020-02-08 23:02

4 security issues in jessie high

There are 4 open security issues in jessie.

3 important issues:

CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

1 issue skipped by the security teams:

CVE-2015-2156: Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Please fix them.

Created: 2015-07-12 Last update: 2020-02-08 23:02

3 security issues in stretch high

There are 3 open security issues in stretch.

3 important issues:

CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Please fix them.

Created: 2020-01-30 Last update: 2020-02-08 23:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.4.1).

Created: 2020-01-21 Last update: 2020-01-21 05:06

news

[2020-01-14] netty 1:4.1.33-3 MIGRATED to testing (Debian testing watch)
[2020-01-09] Accepted netty 1:4.1.33-3 (source) into unstable (tony mancill)
[2020-01-08] Accepted netty 1:4.1.7-2+deb9u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Salvatore Bonaccorso)
[2020-01-06] Accepted netty 1:4.1.33-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2020-01-05] netty 1:4.1.33-2 MIGRATED to testing (Debian testing watch)
[2020-01-03] Accepted netty 1:4.1.33-1+deb10u1 (source) into stable->embargoed, stable (Salvatore Bonaccorso)
[2020-01-03] Accepted netty 1:4.1.7-2+deb9u1 (source) into oldstable->embargoed, oldstable (Salvatore Bonaccorso)
[2020-01-03] Accepted netty 1:4.1.33-2 (source) into unstable (Salvatore Bonaccorso) (signed by: tony mancill)
[2019-09-30] Accepted netty 1:3.2.6.Final-2+deb8u1 (source all) into oldoldstable (Mike Gabriel)
[2019-01-27] netty 1:4.1.33-1 MIGRATED to testing (Debian testing watch)
[2019-01-22] Accepted netty 1:4.1.33-1 (source) into unstable (Emmanuel Bourg)
[2018-09-10] netty 1:4.1.29-1 MIGRATED to testing (Debian testing watch)
[2018-09-04] Accepted netty 1:4.1.29-1 (source) into unstable (Emmanuel Bourg)
[2017-08-06] netty 1:4.1.7-4 MIGRATED to testing (Debian testing watch)
[2017-07-30] Accepted netty 1:4.1.7-4 (source all) into unstable (tony mancill)
[2017-07-28] netty 1:4.1.7-3 MIGRATED to testing (Debian testing watch)
[2017-07-23] Accepted netty 1:4.1.7-3 (source all) into unstable (tony mancill)
[2017-02-03] netty 1:4.1.7-2 MIGRATED to testing (Debian testing watch)
[2017-01-23] Accepted netty 1:4.1.7-2 (source all) into unstable (Emmanuel Bourg)
[2017-01-16] Accepted netty 1:4.1.7-1 (source all) into unstable (Emmanuel Bourg)
[2016-11-04] netty 1:4.0.42-1 MIGRATED to testing (Debian testing watch)
[2016-10-29] Accepted netty 1:4.0.42-1 (source all) into unstable (Emmanuel Bourg)
[2016-09-04] netty 1:4.0.41-1 MIGRATED to testing (Debian testing watch)
[2016-08-30] Accepted netty 1:4.0.41-1 (source all) into unstable (Emmanuel Bourg)
[2016-08-09] netty 1:4.0.40-1 MIGRATED to testing (Debian testing watch)
[2016-08-02] Accepted netty 1:4.0.40-1 (source all) into unstable (Emmanuel Bourg)
[2016-06-21] netty 1:4.0.37-1 MIGRATED to testing (Debian testing watch)
[2016-06-18] Accepted netty 1:4.0.37-1 (source all) into unstable (tony mancill)
[2016-05-29] netty 1:4.0.36-2 MIGRATED to testing (Debian testing watch)
[2016-05-23] Accepted netty 1:4.0.36-2 (source all) into unstable (Emmanuel Bourg)

1
2

bugs [bug history graph]

all: 2
RC: 2
I&N: 0
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:4.1.33-3

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing