Vulnerability Description
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netty | Netty | <= 3.9.7 |
| Lightbend | Play Framework | 2.0 |
| Playframework | Play Framework | 2.0 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.htmlThird Party Advisory
- http://netty.io/news/2015/05/08/3-9-8-Final-and-3.htmlVendor Advisory
- http://www.openwall.com/lists/oss-security/2015/05/17/1Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/74704Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1222923Issue TrackingThird Party Advisory
- https://github.com/netty/netty/pull/3754Third Party Advisory
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b667
- https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e
- https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd9
- https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypasThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.htmlThird Party Advisory
- http://netty.io/news/2015/05/08/3-9-8-Final-and-3.htmlVendor Advisory
FAQ
What is CVE-2015-2156?
CVE-2015-2156 is a vulnerability with a CVSS score of 7.5 (HIGH). Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly fl...
How severe is CVE-2015-2156?
CVE-2015-2156 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-2156?
Check the references section above for vendor advisories and patch information. Affected products include: Netty Netty, Lightbend Play Framework, Playframework Play Framework.