7.5

CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netty ≫ Netty Version <= 3.9.7
Netty ≫ Netty Version 3.10.0
Netty ≫ Netty Version 3.10.1
Netty ≫ Netty Version 3.10.2
Netty ≫ Netty Version 4.0.0
Netty ≫ Netty Version 4.0.1
Netty ≫ Netty Version 4.0.2
Netty ≫ Netty Version 4.0.3
Netty ≫ Netty Version 4.0.4
Netty ≫ Netty Version 4.0.5
Netty ≫ Netty Version 4.0.6
Netty ≫ Netty Version 4.0.7
Netty ≫ Netty Version 4.0.8
Netty ≫ Netty Version 4.0.9
Netty ≫ Netty Version 4.0.10
Netty ≫ Netty Version 4.0.11
Netty ≫ Netty Version 4.0.12
Netty ≫ Netty Version 4.0.13
Netty ≫ Netty Version 4.0.14
Netty ≫ Netty Version 4.0.15
Netty ≫ Netty Version 4.0.16
Netty ≫ Netty Version 4.0.17
Netty ≫ Netty Version 4.0.18
Netty ≫ Netty Version 4.0.19
Netty ≫ Netty Version 4.0.20
Netty ≫ Netty Version 4.0.21
Netty ≫ Netty Version 4.0.22
Netty ≫ Netty Version 4.0.23
Netty ≫ Netty Version 4.0.24
Netty ≫ Netty Version 4.0.25
Netty ≫ Netty Version 4.0.26
Netty ≫ Netty Version 4.0.27
Netty ≫ Netty Version 4.1.0 Update beta1
Netty ≫ Netty Version 4.1.0 Update beta2
Netty ≫ Netty Version 4.1.0 Update beta3
Netty ≫ Netty Version 4.1.0 Update beta4
Lightbend ≫ Play Framework Version 2.0 Update rc3
Lightbend ≫ Play Framework Version 2.0 Update rc4
Lightbend ≫ Play Framework Version 2.0 Update rc5
Lightbend ≫ Play Framework Version 2.0.2
Lightbend ≫ Play Framework Version 2.0.2 Update rc1
Lightbend ≫ Play Framework Version 2.0.2 Update rc2
Lightbend ≫ Play Framework Version 2.0.3
Lightbend ≫ Play Framework Version 2.0.3 Update rc1
Lightbend ≫ Play Framework Version 2.0.3 Update rc2
Lightbend ≫ Play Framework Version 2.0.4
Lightbend ≫ Play Framework Version 2.0.4 Update rc1
Lightbend ≫ Play Framework Version 2.0.4 Update rc2
Lightbend ≫ Play Framework Version 2.0.5
Lightbend ≫ Play Framework Version 2.0.5 Update rc1
Lightbend ≫ Play Framework Version 2.0.5 Update rc2
Lightbend ≫ Play Framework Version 2.0.6
Lightbend ≫ Play Framework Version 2.0.7
Lightbend ≫ Play Framework Version 2.0.8
Lightbend ≫ Play Framework Version 2.1.0
Lightbend ≫ Play Framework Version 2.1.1
Lightbend ≫ Play Framework Version 2.1.1 Update rc1
Lightbend ≫ Play Framework Version 2.2.0
Lightbend ≫ Play Framework Version 2.2.1
Lightbend ≫ Play Framework Version 2.2.2
Lightbend ≫ Play Framework Version 2.2.6
Lightbend ≫ Play Framework Version 2.3.0
Lightbend ≫ Play Framework Version 2.3.0 Update rc1
Lightbend ≫ Play Framework Version 2.3.0 Update rc2
Lightbend ≫ Play Framework Version 2.3.1
Lightbend ≫ Play Framework Version 2.3.2
Lightbend ≫ Play Framework Version 2.3.2 Update rc1
Lightbend ≫ Play Framework Version 2.3.2 Update rc2
Lightbend ≫ Play Framework Version 2.3.3
Lightbend ≫ Play Framework Version 2.3.4
Lightbend ≫ Play Framework Version 2.3.5
Lightbend ≫ Play Framework Version 2.3.6
Lightbend ≫ Play Framework Version 2.3.7
Lightbend ≫ Play Framework Version 2.3.8
Playframework ≫ Play Framework Version 2.0
Playframework ≫ Play Framework Version 2.0 Update beta
Playframework ≫ Play Framework Version 2.0 Update rc1
Playframework ≫ Play Framework Version 2.0 Update rc2
Playframework ≫ Play Framework Version 2.0.1
Playframework ≫ Play Framework Version 2.1.1 Update 2.9.x-backport
Playframework ≫ Play Framework Version 2.1.1 Update rc1-2.9.x-backport
Playframework ≫ Play Framework Version 2.1.1 Update rc2
Playframework ≫ Play Framework Version 2.1.2
Playframework ≫ Play Framework Version 2.1.2 Update rc1
Playframework ≫ Play Framework Version 2.1.2 Update rc2
Playframework ≫ Play Framework Version 2.1.3
Playframework ≫ Play Framework Version 2.1.3 Update rc1
Playframework ≫ Play Framework Version 2.1.3 Update rc2
Playframework ≫ Play Framework Version 2.1.4
Playframework ≫ Play Framework Version 2.1.4 Update rc1
Playframework ≫ Play Framework Version 2.1.4 Update rc2
Playframework ≫ Play Framework Version 2.1.5
Playframework ≫ Play Framework Version 2.1.6
Playframework ≫ Play Framework Version 2.1.6 Update rc1
Playframework ≫ Play Framework Version 2.2.0 Update m1
Playframework ≫ Play Framework Version 2.2.0 Update m2
Playframework ≫ Play Framework Version 2.2.0 Update m3
Playframework ≫ Play Framework Version 2.2.0 Update rc1
Playframework ≫ Play Framework Version 2.2.0 Update rc2
Playframework ≫ Play Framework Version 2.2.1 Update rc1
Playframework ≫ Play Framework Version 2.2.2 Update rc1
Playframework ≫ Play Framework Version 2.2.2 Update rc2
Playframework ≫ Play Framework Version 2.2.2 Update rc3
Playframework ≫ Play Framework Version 2.2.2 Update rc4
Playframework ≫ Play Framework Version 2.2.3
Playframework ≫ Play Framework Version 2.2.3 Update rc1
Playframework ≫ Play Framework Version 2.2.3 Update rc2
Playframework ≫ Play Framework Version 2.2.4
Playframework ≫ Play Framework Version 2.2.5
Playframework ≫ Play Framework Version 2.3 Update m1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.22% 0.917
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html
Third Party Advisory
http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/05/17/1
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/74704
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1222923
Third Party Advisory
Issue Tracking
https://github.com/netty/netty/pull/3754
Third Party Advisory
https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apache.org%3E
https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apache.org%3E
https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
Third Party Advisory