CVE & CISA-KEV Catalog

CVE-2020-7238

HIGHEPSS 88th pctl
7.5
CVSS v3
NVD

Description

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CWE-444

How to fix

Remediation Available
nettyDebian
Fixed in:1:4.1.45-1CVE-2020-7238
Fixed in:1:4.1.45-1CVE-2020-7238
Fixed in:1:4.1.45-1CVE-2020-7238
Fixed in:1:4.1.45-1CVE-2020-7238
eap7-apache-cxfRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxfRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-rtRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-rtRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-servicesRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-servicesRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-toolsRed Hat / RHEL
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-apache-cxf-toolsRocky
Fixed in:0:3.1.16-3.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-avroRocky
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
eap7-avroRed Hat / RHEL
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.7.6-2.redhat_00003.1.ep7.el7RHSA-2024:10208
eap7-bouncycastleRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastleRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-mailRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-mailRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-pkixRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-pkixRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-provRocky
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-bouncycastle-provRed Hat / RHEL
Fixed in:0:1.68.0-1.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-h2databaseRed Hat / RHEL
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-h2databaseRocky
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
Fixed in:0:1.4.197-2.redhat_00005.1.ep7.el7RHSA-2024:10208
eap7-jackson-databindRocky
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jackson-databindRed Hat / RHEL
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.8.11.6-1.SP1_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshallingRocky
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshallingRed Hat / RHEL
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshalling-riverRed Hat / RHEL
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-marshalling-riverRocky
Fixed in:0:2.0.15-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-xnio-baseRed Hat / RHEL
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-jboss-xnio-baseRocky
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
Fixed in:0:3.5.10-1.Final_redhat_00001.1.ep7.el7RHSA-2024:10208
eap7-wildflyRocky
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-wildflyRed Hat / RHEL
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-wildfly-modulesRocky
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-wildfly-modulesRed Hat / RHEL
Fixed in:0:7.1.8-2.GA_redhat_00002.1.ep7.el7RHSA-2024:10208
eap7-xalan-j2Red Hat / RHEL
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
eap7-xalan-j2Rocky
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
Fixed in:0:2.7.1-26.redhat_00015.1.ep7.el7RHSA-2024:10208
libnetty-3.9-javaUbuntu
Fixed in:3.9.0.Final-1ubuntu0.1USN-4600-1
netty-3.9Ubuntu
Fixed in:3.9.0.Final-1ubuntu0.1USN-4600-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityHigh
AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploit Intelligence

3.62%probability of exploitation in 30 days
88thpercentile

Elevated risk: more likely to be exploited than 88% of all known CVEs.

References

Exploit1
Vendor Advisory1
Embed a live status badge for CVE-2020-7238
CVE-2020-7238 severity badge

Markdown

[![CVE-2020-7238](https://tridentstack.com/cve/badge/CVE-2020-7238.svg)](https://tridentstack.com/cve/CVE-2020-7238)

HTML

<a href="https://tridentstack.com/cve/CVE-2020-7238"><img src="https://tridentstack.com/cve/badge/CVE-2020-7238.svg" alt="CVE-2020-7238"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.