p PatchFirst

CVE-2015-2156

CVE-2015-2156

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.

CVSS 7.5 · High · EPSS 5.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • netty Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:4.0.31-1

    Update to 1:4.0.31-1

  • netty Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:4.0.31-1

    Update to 1:4.0.31-1

  • netty Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:4.0.31-1

    Update to 1:4.0.31-1

  • netty Ubuntu:Pro:14.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
    • 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-3.9 Ubuntu:16.04:LTS

    Versions
    • 3.9.0.Final-1
    • 3.9.0.Final-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →