Skip to content
Fencer Vulns
medium 5.5

CVE-2022-24823 json

Local Information Disclosure Vulnerability in io.netty:netty-codec-http

published 2022-05-06 4 y ago modified 2026-08-07 3 mo ago also GHSA-269q-hmxg-m83q , EUVD-2022-1918

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

Patch / fix

  • maven io.netty:netty-codec-http 4.1.77.Final
  • netty netty 4.1.77
  • netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm2
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm3
  • netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm2
  • netty Ubuntu Pro 22.04 LTS 1:4.1.48-4+deb11u2ubuntu0.1~esm1
  • netty Ubuntu Pro 24.04 LTS 1:4.1.48-9ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-24823

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7 jboss enterprise application platform 7.4 1-18.el9eap
  • eap7-ecj jboss enterprise application platform 7.4 1:3.26.0-1.redhat_00002.1.el9eap
  • eap7-vdx jboss enterprise application platform 7.4 1.1.6-2.redhat_1.1.el9eap
  • eap7-xom jboss enterprise application platform 7.4 1.3.7-1.redhat_00001.1.el9eap
  • eap7-avro jboss enterprise application platform 7.4 1.7.6-7.1.redhat_2.1.el9eap
  • eap7-gson jboss enterprise application platform 7.4 2.8.9-1.redhat_00001.1.el9eap
  • eap7-txw2 jboss enterprise application platform 7.4 2.3.3-4.1.b02_redhat_00001.1.el9eap
  • eap7-xsom jboss enterprise application platform 7.4 2.3.3-4.1.b02_redhat_00001.1.el9eap

red hat advisories RHSA-2022:5894RHSA-2022:5893RHSA-2022:5892

  • netty-tcnative SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +11 more 2.0.59-150200.3.10.1
  • netty SLE Module for Package Hub 15 SP5, openSUSE Leap 15.5, openSUSE Leap 15.4 4.1.90-150200.4.14.1

suse advisories SUSE-SU-2023:2096-2SUSE-SU-2023:2096-1

  • netty openSUSE Tumbleweed 4.1.114-1.1

opensuse advisories openSUSE-SU-2024:14442-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-24823 updated cvss 5.5

netty: world readable temporary file containing sensitive data

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8
    affected: workaround, no fix planned “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.”
  • Red Hat build of Quarkus netty netty
    affected: workaround, no fix available “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.”
  • Red Hat Decision Manager 7 netty netty Red Hat JBoss A-MQ 6 netty netty Red Hat JBoss Data Grid 7 netty netty Red Hat JBoss Enterprise Application Platform 5 netty netty Red Hat JBoss Enterprise Application Platform 6 netty netty Red Hat JBoss Enterprise Application Platform Expansion Pack netty netty
    +3 more products
    Red Hat JBoss Fuse 6 netty netty Red Hat JBoss Operations Network 3 netty netty Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5
    affected: workaround, no fix planned “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto, openshift4/ose-logging-elasticsearch5, openshift4/ose-logging-elasticsearch6
    affected: workaround, no fix available, no fix planned “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.”
  • Red Hat Process Automation 7 netty netty Red Hat Single Sign-On 7 netty netty
    affected: workaround, no fix planned “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.”
  • Red Hat AMQ Broker 7.10.1
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:6916
  • Red Hat AMQ Streams 2.2.0
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:6819
  • Red Hat AMQ Streams 2.4.0
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2023:3223
show 8 more
  • Red Hat AMQ Streams 2.5.0
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2023:5165
  • Red Hat Data Grid 8.4.0
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:8524
  • Red Hat Fuse 7.11.1
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:8652
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-netty 4.1.77-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.77-1.Final_redhat_00001.1.el7eap, eap7-netty-codec 4.1.77-1.Final_redhat_00001.1.el7eap, eap7-netty-buffer 4.1.77-1.Final_redhat_00001.1.el7eap, eap7-netty-common 4.1.77-1.Final_redhat_00001.1.el7eap, eap7-netty-handler 4.1.77-1.Final_redhat_00001.1.el7eap, +22 more
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:5892
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-netty 4.1.77-1.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.77-1.Final_redhat_00001.1.el8eap, eap7-netty-codec 4.1.77-1.Final_redhat_00001.1.el8eap, eap7-netty-buffer 4.1.77-1.Final_redhat_00001.1.el8eap, eap7-netty-common 4.1.77-1.Final_redhat_00001.1.el8eap, eap7-netty-handler 4.1.77-1.Final_redhat_00001.1.el8eap, +22 more
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:5893
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7 1-18.el9eap, eap7-runtime 1-18.el9eap, eap7-vdx 1.1.6-2.redhat_1.1.el9eap, eap7-antlr 2.7.7-54.redhat_7.1.el9eap, eap7-avro 1.7.6-7.1.redhat_2.1.el9eap, eap7-cal10n 0.8.1-6.redhat_1.1.el9eap, +414 more
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:5894
  • Red Hat JBoss Enterprise Application Platform netty-codec-http 4.1.77.Final-redhat-00001
    fixed: vendor fix “As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.” RHSA-2022:5928
  • Red Hat A-MQ Clients 2 netty netty Red Hat A-MQ Online netty netty Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-gson 2.8.9-1.redhat_00001.1.el7eap, eap7-jberet 1.3.9-2.SP2_redhat_00001.1.el7eap, eap7-wildfly 7.4.6-5.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.3.13-1.redhat_00001.1.el7eap, eap7-jandex 2.4.2-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.18-2.SP2_redhat_00001.1.el7eap, +54 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-gson 2.8.9-1.redhat_00001.1.el8eap, eap7-jberet 1.3.9-2.SP2_redhat_00001.1.el8eap, eap7-wildfly 7.4.6-5.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.3.13-1.redhat_00001.1.el8eap, eap7-jandex 2.4.2-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.2.18-2.SP2_redhat_00001.1.el8eap, +52 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1483 more Red Hat OpenShift Application Runtimes netty netty
    +1 more products
    Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/netty/netty/security/advisories/GHSA-269q-hmxg-m83q referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-codec-http
<4.1.77.Final
4.1.77.Final

Affected products

  • netty netty

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere
  • CWE-378 Creation of Temporary File With Insecure Permissions
  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.