CVE-2019-20444

Vulnerability

Analysis

CVE-2019-20447 is a parsing flaw in Netty's HttpObjectDecoder.java that affects versions before 4.1.44. The root cause is that the decoder incorrectly handles HTTP header lines that do not contain a colon (:). According to the official description, such a header might be interpreted as a separate malformed header or as an "invalid fold," meaning the parser may treat it as a continuation of the previous header field value rather than a new header. This deviation from RFC 7230 parsing rules can lead to inconsistent interpretations between the HTTP frontend and backend.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious HTTP request or response that contains a header line without a colon. The attack surface is the network layer, as the malformed data is sent to any Netty-based server that processes HTTP messages. No authentication is required; the attack can be performed remotely by sending a specially crafted HTTP header sequence. The prerequisite is that the server uses a vulnerable version of Netty (before 4.1.44) and directly passes the parsed headers to downstream components.

Impact

Successful exploitation can result in HTTP request smuggling or response splitting, depending on whether the attack targets a request or a response. An attacker could cause the frontend and backend to disagree on request boundaries, potentially allowing the attacker to inject arbitrary HTTP requests, poison caches, or perform session hijacking [1][2]. The impact severity is high because it can bypass security controls and lead to data exposure or impersonation.

Mitigation

The Netty project fixed this issue in version 4.1.44 by properly rejecting or correcting header lines that lack a colon. Red Hat issued security updates for Netty in Red Hat Enterprise Linux (via RHSA-2020:0601) and JBoss Enterprise Application Platform (via RHSA-2020:0804, RHSA-2020:0805, RHSA-2020:0806) to include the patched version [1][2][3][4]. Users should upgrade to Netty 4.1.44 or later, or apply the relevant Red Hat erratum.