CVE-2022-24823

Name of the Vulnerable Software and Affected Versions io.netty:netty-codec-http versions prior to 4.1.77.Final

Description The issue is related to insufficient fix for a vulnerability in Netty's multipart decoders, which can lead to local information disclosure via the local system temporary directory if temporary storing uploads on the disk is enabled. This affects applications running on Java version 6 and lower, as well as code running on Unix-like systems, and very old versions of Mac OSX and Windows, as they share the system temporary directory between all users.

Recommendations For versions prior to 4.1.77.Final, update to 4.1.77.Final to fix the vulnerability. As a workaround, specify your own java.io.tmpdir when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. Alternatively, update to Java 7 or above to mitigate the issue.