CVE-2015-2156
Summary
| CVE | CVE-2015-2156 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-10-18 15:29:00 UTC |
| Updated | 2023-11-07 02:25:00 UTC |
| Description | Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Lightbend | Play Framework | 2.0 | rc3 | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc4 | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc5 | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.7 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.8 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.1 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.2.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.3.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.3.3 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.4 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.5 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.7 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.8 | All | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc3 | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc4 | All | All |
| Application | Lightbend | Play Framework | 2.0 | rc5 | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.2 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.3 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.4 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.0.5 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.0.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.7 | All | All | All |
| Application | Lightbend | Play Framework | 2.0.8 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.1.1 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.2.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.2.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.3.0 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.3.1 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | rc1 | All | All |
| Application | Lightbend | Play Framework | 2.3.2 | rc2 | All | All |
| Application | Lightbend | Play Framework | 2.3.3 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.4 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.5 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.6 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.7 | All | All | All |
| Application | Lightbend | Play Framework | 2.3.8 | All | All | All |
| Application | Netty | Netty | 3.10.0 | All | All | All |
| Application | Netty | Netty | 3.10.1 | All | All | All |
| Application | Netty | Netty | 3.10.2 | All | All | All |
| Application | Netty | Netty | 4.0.0 | All | All | All |
| Application | Netty | Netty | 4.0.1 | All | All | All |
| Application | Netty | Netty | 4.0.10 | All | All | All |
| Application | Netty | Netty | 4.0.11 | All | All | All |
| Application | Netty | Netty | 4.0.12 | All | All | All |
| Application | Netty | Netty | 4.0.13 | All | All | All |
| Application | Netty | Netty | 4.0.14 | All | All | All |
| Application | Netty | Netty | 4.0.15 | All | All | All |
| Application | Netty | Netty | 4.0.16 | All | All | All |
| Application | Netty | Netty | 4.0.17 | All | All | All |
| Application | Netty | Netty | 4.0.18 | All | All | All |
| Application | Netty | Netty | 4.0.19 | All | All | All |
| Application | Netty | Netty | 4.0.2 | All | All | All |
| Application | Netty | Netty | 4.0.20 | All | All | All |
| Application | Netty | Netty | 4.0.21 | All | All | All |
| Application | Netty | Netty | 4.0.22 | All | All | All |
| Application | Netty | Netty | 4.0.23 | All | All | All |
| Application | Netty | Netty | 4.0.24 | All | All | All |
| Application | Netty | Netty | 4.0.25 | All | All | All |
| Application | Netty | Netty | 4.0.26 | All | All | All |
| Application | Netty | Netty | 4.0.27 | All | All | All |
| Application | Netty | Netty | 4.0.3 | All | All | All |
| Application | Netty | Netty | 4.0.4 | All | All | All |
| Application | Netty | Netty | 4.0.5 | All | All | All |
| Application | Netty | Netty | 4.0.6 | All | All | All |
| Application | Netty | Netty | 4.0.7 | All | All | All |
| Application | Netty | Netty | 4.0.8 | All | All | All |
| Application | Netty | Netty | 4.0.9 | All | All | All |
| Application | Netty | Netty | 4.1.0 | beta1 | All | All |
| Application | Netty | Netty | 4.1.0 | beta2 | All | All |
| Application | Netty | Netty | 4.1.0 | beta3 | All | All |
| Application | Netty | Netty | 4.1.0 | beta4 | All | All |
| Application | Netty | Netty | 3.10.0 | All | All | All |
| Application | Netty | Netty | 3.10.1 | All | All | All |
| Application | Netty | Netty | 3.10.2 | All | All | All |
| Application | Netty | Netty | 4.0.0 | All | All | All |
| Application | Netty | Netty | 4.0.1 | All | All | All |
| Application | Netty | Netty | 4.0.10 | All | All | All |
| Application | Netty | Netty | 4.0.11 | All | All | All |
| Application | Netty | Netty | 4.0.12 | All | All | All |
| Application | Netty | Netty | 4.0.13 | All | All | All |
| Application | Netty | Netty | 4.0.14 | All | All | All |
| Application | Netty | Netty | 4.0.15 | All | All | All |
| Application | Netty | Netty | 4.0.16 | All | All | All |
| Application | Netty | Netty | 4.0.17 | All | All | All |
| Application | Netty | Netty | 4.0.18 | All | All | All |
| Application | Netty | Netty | 4.0.19 | All | All | All |
| Application | Netty | Netty | 4.0.2 | All | All | All |
| Application | Netty | Netty | 4.0.20 | All | All | All |
| Application | Netty | Netty | 4.0.21 | All | All | All |
| Application | Netty | Netty | 4.0.22 | All | All | All |
| Application | Netty | Netty | 4.0.23 | All | All | All |
| Application | Netty | Netty | 4.0.24 | All | All | All |
| Application | Netty | Netty | 4.0.25 | All | All | All |
| Application | Netty | Netty | 4.0.26 | All | All | All |
| Application | Netty | Netty | 4.0.27 | All | All | All |
| Application | Netty | Netty | 4.0.3 | All | All | All |
| Application | Netty | Netty | 4.0.4 | All | All | All |
| Application | Netty | Netty | 4.0.5 | All | All | All |
| Application | Netty | Netty | 4.0.6 | All | All | All |
| Application | Netty | Netty | 4.0.7 | All | All | All |
| Application | Netty | Netty | 4.0.8 | All | All | All |
| Application | Netty | Netty | 4.0.9 | All | All | All |
| Application | Netty | Netty | 4.1.0 | beta1 | All | All |
| Application | Netty | Netty | 4.1.0 | beta2 | All | All |
| Application | Netty | Netty | 4.1.0 | beta3 | All | All |
| Application | Netty | Netty | 4.1.0 | beta4 | All | All |
| Application | Netty | Netty | All | All | All | All |
| Application | Playframework | Play Framework | 2.0 | All | All | All |
| Application | Playframework | Play Framework | 2.0 | beta | All | All |
| Application | Playframework | Play Framework | 2.0 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.0 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.0.1 | All | All | All |
| Application | Playframework | Play Framework | 2.1.1 | 2.9.x-backport | All | All |
| Application | Playframework | Play Framework | 2.1.1 | rc1-2.9.x-backport | All | All |
| Application | Playframework | Play Framework | 2.1.1 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.2 | All | All | All |
| Application | Playframework | Play Framework | 2.1.2 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.2 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.3 | All | All | All |
| Application | Playframework | Play Framework | 2.1.3 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.3 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.4 | All | All | All |
| Application | Playframework | Play Framework | 2.1.4 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.4 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.5 | All | All | All |
| Application | Playframework | Play Framework | 2.1.6 | All | All | All |
| Application | Playframework | Play Framework | 2.1.6 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m2 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m3 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.1 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc3 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc4 | All | All |
| Application | Playframework | Play Framework | 2.2.3 | All | All | All |
| Application | Playframework | Play Framework | 2.2.3 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.3 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.4 | All | All | All |
| Application | Playframework | Play Framework | 2.2.5 | All | All | All |
| Application | Playframework | Play Framework | 2.3 | m1 | All | All |
| Application | Playframework | Play Framework | 2.0 | All | All | All |
| Application | Playframework | Play Framework | 2.0 | beta | All | All |
| Application | Playframework | Play Framework | 2.0 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.0 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.0.1 | All | All | All |
| Application | Playframework | Play Framework | 2.1.1 | 2.9.x-backport | All | All |
| Application | Playframework | Play Framework | 2.1.1 | rc1-2.9.x-backport | All | All |
| Application | Playframework | Play Framework | 2.1.1 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.2 | All | All | All |
| Application | Playframework | Play Framework | 2.1.2 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.2 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.3 | All | All | All |
| Application | Playframework | Play Framework | 2.1.3 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.3 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.4 | All | All | All |
| Application | Playframework | Play Framework | 2.1.4 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.1.4 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.1.5 | All | All | All |
| Application | Playframework | Play Framework | 2.1.6 | All | All | All |
| Application | Playframework | Play Framework | 2.1.6 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m2 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | m3 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.0 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.1 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc3 | All | All |
| Application | Playframework | Play Framework | 2.2.2 | rc4 | All | All |
| Application | Playframework | Play Framework | 2.2.3 | All | All | All |
| Application | Playframework | Play Framework | 2.2.3 | rc1 | All | All |
| Application | Playframework | Play Framework | 2.2.3 | rc2 | All | All |
| Application | Playframework | Play Framework | 2.2.4 | All | All | All |
| Application | Playframework | Play Framework | 2.2.5 | All | All | All |
| Application | Playframework | Play Framework | 2.3 | m1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | lists.apache.org | ||
| [SECURITY] Fedora 21 Update: netty-4.0.28-1.fc21 | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Validate cookie name and value characters by slandelle · Pull Request #3754 · netty/netty · GitHub | CONFIRM | github.com | Third Party Advisory |
| Netty and Play Framework CVE-2015-2156 Session Hijacking Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Pony Mail! | MLIST | lists.apache.org | |
| Play Framework Security Advisory | MISC | www.playframework.com | Third Party Advisory |
| [SECURITY] Fedora 22 Update: netty-4.0.28-1.fc22 | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| 1222923 – (CVE-2015-2156) CVE-2015-2156 netty: HttpOnly cookie bypass | CONFIRM | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| oss-security - Netty/Play's Security Updates (CVE-2015-2156) | MLIST | www.openwall.com | Mailing List, Third Party Advisory |
| Netty.news: Netty 3.9.8.Final and 3.10.3.Final released | CONFIRM | netty.io | Vendor Advisory |
| Pony Mail! | lists.apache.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 980761 Java (maven) Security Update for io.netty:netty-handler (GHSA-xfv3-rrfm-f2rv)