This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2015-2156 →
DEBIAN-CVE-2015-2156
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 migh...
Original description
The description as published by the source.
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
netty
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.31-1"}]}]
Debian:13
netty
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.31-1"}]}]
Debian:14
netty
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.31-1"}]}]
References
- advisory security-tracker.debian.org