CVE-2015-2156
Summary
| CVE | CVE-2015-2156 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-10-18 15:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. |
Risk And Classification
Primary CVSS: v3.0 7.5 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-20 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Lightbend | Play Framework | 2.0 | rc3 | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc4 | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc5 | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.7 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.8 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.1 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.2.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.3.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.3.3 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.4 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.5 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.7 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.8 | All | All | All |
| Application | Netty | Netty | 3.10.0 | All | All | All |
| Application | Netty | Netty | 3.10.1 | All | All | All |
| Application | Netty | Netty | 3.10.2 | All | All | All |
| Application | Netty | Netty | 4.0.0 | All | All | All |
| Application | Netty | Netty | 4.0.1 | All | All | All |
| Application | Netty | Netty | 4.0.10 | All | All | All |
| Application | Netty | Netty | 4.0.11 | All | All | All |
| Application | Netty | Netty | 4.0.12 | All | All | All |
| Application | Netty | Netty | 4.0.13 | All | All | All |
| Application | Netty | Netty | 4.0.14 | All | All | All |
| Application | Netty | Netty | 4.0.15 | All | All | All |
| Application | Netty | Netty | 4.0.16 | All | All | All |
| Application | Netty | Netty | 4.0.17 | All | All | All |
| Application | Netty | Netty | 4.0.18 | All | All | All |
| Application | Netty | Netty | 4.0.19 | All | All | All |
| Application | Netty | Netty | 4.0.2 | All | All | All |
| Application | Netty | Netty | 4.0.20 | All | All | All |
| Application | Netty | Netty | 4.0.21 | All | All | All |
| Application | Netty | Netty | 4.0.22 | All | All | All |
| Application | Netty | Netty | 4.0.23 | All | All | All |
| Application | Netty | Netty | 4.0.24 | All | All | All |
| Application | Netty | Netty | 4.0.25 | All | All | All |
| Application | Netty | Netty | 4.0.26 | All | All | All |
| Application | Netty | Netty | 4.0.27 | All | All | All |
| Application | Netty | Netty | 4.0.3 | All | All | All |
| Application | Netty | Netty | 4.0.4 | All | All | All |
| Application | Netty | Netty | 4.0.5 | All | All | All |
| Application | Netty | Netty | 4.0.6 | All | All | All |
| Application | Netty | Netty | 4.0.7 | All | All | All |
| Application | Netty | Netty | 4.0.8 | All | All | All |
| Application | Netty | Netty | 4.0.9 | All | All | All |
| Application | Netty | Netty | 4.1.0 | beta1 | All | All |
| Application | Netty | Netty | 4.1.0 | beta2 | All | All |
| Application | Netty | Netty | 4.1.0 | beta3 | All | All |
| Application | Netty | Netty | 4.1.0 | beta4 | All | All |
| Application | Netty | Netty | All | All | All | All |
| Application | Playframework | Play Framework | 2.0 | All | All | All |
| Application | Playframework | Play Framework | 2.0 | beta | All | All |
| Application | Playframework | Play Framework | 2.0 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.0 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.0.1 | All | All | All |
| Application | Playframework | Play Framework | 2.1.1 | 2.9.x-backport | All | All |
| Application | Playframework | Play Framework | 2.1.1 | rc1-2.9.x-backport | All | All |
| Application | Playframework | Play Framework | 2.1.1 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.2 | All | All | All |
| Application | Playframework | Play Framework | 2.1.2 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.2 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.3 | All | All | All |
| Application | Playframework | Play Framework | 2.1.3 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.3 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.4 | All | All | All |
| Application | Playframework | Play Framework | 2.1.4 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.4 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.5 | All | All | All |
| Application | Playframework | Play Framework | 2.1.6 | All | All | All |
| Application | Playframework | Play Framework | 2.1.6 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m2 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m3 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.1 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc3 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc4 | All | All |
| Application | Playframework | Play Framework | 2.2.3 | All | All | All |
| Application | Playframework | Play Framework | 2.2.3 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.3 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.4 | All | All | All |
| Application | Playframework | Play Framework | 2.2.5 | All | All | All |
| Application | Playframework | Play Framework | 2.3 | m1 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 1222923 – (CVE-2015-2156) CVE-2015-2156 netty: HttpOnly cookie bypass | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| oss-security - Netty/Play's Security Updates (CVE-2015-2156) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Third Party Advisory |
| Netty and Play Framework CVE-2015-2156 Session Hijacking Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| Validate cookie name and value characters by slandelle · Pull Request #3754 · netty/netty · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Third Party Advisory |
| Pony Mail! | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| [SECURITY] Fedora 22 Update: netty-4.0.28-1.fc22 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Third Party Advisory |
| [SECURITY] Fedora 21 Update: netty-4.0.28-1.fc21 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Third Party Advisory |
| Netty.news: Netty 3.9.8.Final and 3.10.3.Final released | af854a3a-2127-422b-91ae-364da2661108 | netty.io | Vendor Advisory |
| Play Framework Security Advisory | af854a3a-2127-422b-91ae-364da2661108 | www.playframework.com | Third Party Advisory |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980761 Java (maven) Security Update for io.netty:netty-handler (GHSA-xfv3-rrfm-f2rv)