← Voltar para CVEs

CVE-2015-2156

N/A

Descricao

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

Detalhes CVE

Pontuacao CVSS v3.1N/A

Publicado10/18/2017

Ultima modificacao4/20/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

lightbend:play_frameworknetty:nettyplayframework:play_framework

Fraquezas (CWE)

CWE-20

Referencias

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html(cve@mitre.org)

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html(cve@mitre.org)

http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html(cve@mitre.org)

http://www.openwall.com/lists/oss-security/2015/05/17/1(cve@mitre.org)

http://www.securityfocus.com/bid/74704(cve@mitre.org)

https://bugzilla.redhat.com/show_bug.cgi?id=1222923(cve@mitre.org)

https://github.com/netty/netty/pull/3754(cve@mitre.org)

https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E(cve@mitre.org)

https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apache.org%3E(cve@mitre.org)

https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apache.org%3E(cve@mitre.org)

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E(cve@mitre.org)

https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass(cve@mitre.org)

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html(af854a3a-2127-422b-91ae-364da2661108)

http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.openwall.com/lists/oss-security/2015/05/17/1(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/74704(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1222923(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/netty/netty/pull/3754(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.