Homepage

HTTP Response Splitting The advisory has been revoked - it doesn't affect any version of package apache-nifi  (opens in a new tab)

Threat Intelligence

EPSS
0.25% (48th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-APACHENIFI-6862016
  • published17 May 2024
  • disclosed13 Dec 2022
Report a new vulnerability Found a mistake?

Introduced: 13 Dec 2022

CVE-2022-41915  (opens in a new tab)
CWE-113  (opens in a new tab)
CWE-436  (opens in a new tab)

Amendment

The Chainguard security team deemed this advisory irrelevant for Chainguard:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache-nifi package and not the apache-nifi package as distributed by Chainguard.

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling DefaultHttpHeadesr.set with an iterator of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the DefaultHttpHeaders.set(CharSequence, Iterator<?>) call, into a remove() call, and call add() in a loop over the iterator of values.