Register | Log in

netty-3.9

Java NIO client/server socket framework

Choose email to subscribe with

general

source: netty-3.9 (main)
version: 3.9.9.Final-1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Hilko Bengen [DMD]
arch: all
std-ver: 3.9.8
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.9.0.Final-1
o-o-sec: 3.9.0.Final-1+deb8u1
oldstable: 3.9.9.Final-1

versioned links

3.9.0.Final-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.9.0.Final-1+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.9.9.Final-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnetty-3.9-java

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

4 security issues in stretch high

There are 4 open security issues in stretch.

4 important issues:

CVE-2020-7238: Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2019-20444: HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
CVE-2019-20445: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
CVE-2019-16869: Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Please fix them.

Created: 2020-02-06 Last update: 2020-02-19 20:03

1 ignored security issue in jessie low

There is 1 open security issue in jessie.

1 issue skipped by the security teams:

CVE-2015-2156: Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Please fix it.

Created: 2015-07-12 Last update: 2020-02-19 20:03

news

[2020-02-19] Accepted netty-3.9 3.9.0.Final-1+deb8u1 (source all) into oldoldstable (Sylvain Beucler)
[2018-11-29] Removed 3.9.9.Final-2 from unstable (Debian FTP Masters)
[2018-10-12] Accepted netty-3.9 3.9.9.Final-2 (source) into unstable (Emmanuel Bourg)
[2018-09-11] netty-3.9 REMOVED from testing (Debian testing watch)
[2017-01-15] netty-3.9 3.9.9.Final-1 MIGRATED to testing (Debian testing watch)
[2017-01-10] Accepted netty-3.9 3.9.9.Final-1 (source all) into unstable (Emmanuel Bourg)
[2016-06-26] netty-3.9 3.9.0.Final-2 MIGRATED to testing (Debian testing watch)
[2016-06-20] Accepted netty-3.9 3.9.0.Final-2 (source all) into unstable (Emmanuel Bourg)
[2014-09-03] netty-3.9 3.9.0.Final-1 MIGRATED to testing (Britney)

bugs [bug history graph]

all: 0

links

homepage
buildd: logs, clang
popcon
browse source code
edit tags
security tracker

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing