Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Weakness
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Netty | Netty | * | 4.1.137 (excluding) |
| Netty | Netty | 4.2.0 (including) | 4.2.17 (excluding) |
| Red Hat Build of Apache Camel 3.33.3.SP1 | RedHat | io.netty/netty-codec-http:4.1.137.Final-redhat-00001 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-operator-bundle:26.4.17-2 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9:26.4-29 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9-operator:26.4-30 | * |
| Red Hat build of Keycloak 26.4.17 | RedHat | rhbk/keycloak-rhel9 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-operator-bundle:26.6.8-2 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-rhel9:26.6-24 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-rhel9-operator:26.6-24 | * |
| Red Hat build of Keycloak 26.6.8 | RedHat | rhbk/keycloak-rhel9 | * |
| Red Hat build of Quarkus 3.27.5.SP1 | RedHat | io.netty/netty-codec-http:4.1.137.Final-redhat-00001 | * |
| Red Hat build of Quarkus 3.33.3.SP1 | RedHat | io.netty/netty-codec-http:4.1.137.Final-redhat-00001 | * |
| Red Hat JBoss Enterprise Application Platform 8.1 | RedHat | netty-buffer | * |
| Red Hat JBoss Enterprise Application Platform 8.1 | RedHat | netty-codec-http2 | * |
| Red Hat JBoss Enterprise Application Platform 8.1 | RedHat | netty-buffer | * |
| Red Hat JBoss Enterprise Application Platform 8.1 | RedHat | netty-codec-http2 | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 | RedHat | eap8-netty-0:4.1.138-1.Final_redhat_00001.1.el10eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 | RedHat | eap8-netty-transport-native-epoll-0:4.1.138-1.Final_redhat_00001.1.el10eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 | RedHat | eap8-resteasy-0:6.2.19-1.Final_redhat_00002.1.el10eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | RedHat | eap8-netty-0:4.1.138-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | RedHat | eap8-netty-transport-native-epoll-0:4.1.138-1.Final_redhat_00001.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | RedHat | eap8-resteasy-0:6.2.19-1.Final_redhat_00002.1.el8eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | RedHat | eap8-netty-0:4.1.138-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | RedHat | eap8-netty-transport-native-epoll-0:4.1.138-1.Final_redhat_00001.1.el9eap | * |
| Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | RedHat | eap8-resteasy-0:6.2.19-1.Final_redhat_00002.1.el9eap | * |