Summary
Jonathan Leitschuh discovered that Netty did not correctly handle file
permissions when writing temporary files. An attacker could possibly use
this issue to leak sensitive information. (CVE-2022-24823)
It was discovered that Netty did not correctly handle limiting the number
of fields when decoding a HTTP request. An attacker could possibly use
issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-29025)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | netty | 1:4.0.34-1ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | netty | 1:4.1.7-4ubuntu0.1+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | netty | 1:4.1.45-1ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | netty | 1:4.1.48-4+deb11u2ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | netty | 1:4.1.48-9ubuntu0.1~esm1 |
Vulnerabilities 2
-
Medium 5.5
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information…
-
Medium 5.3
Netty HttpPostRequestDecoder can OOM
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `HttpPostRequestDecoder` can be tricked to accumulate data. While the decoder can store items on the dis…