Description
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | netty | 1:4.0.37-1 | — |
| Debian 13 | netty | 1:4.0.37-1 | — |
| Debian 12 | netty | 1:4.0.37-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty-handler | >= 4.0.0.Alpha1, < 4.0.37.Final | 4.0.37.Final | GHSA-rv63-gqm8-9w8q |
| Maven | io.netty:netty-handler | >= 4.1.0.Beta1, < 4.1.1.Final | 4.1.1.Final | GHSA-rv63-gqm8-9w8q |
References
- RHSA-2017:0179 vendor-advisory
- RHSA-2017:1097 vendor-advisory
- http://netty.io/news/2016/06/07/4-1-1-Final.html
- 96540 vdb-entry
- https://github.com/netty/netty/pull/5364
- https://wiki.opendaylight.org/view/Security_Advisories
- http://netty.io/news/2016/06/07/4-0-37-Final.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1343616
- [cassandra-commits] 20191112 [jira] [Created] (CASSANDRA-15412) Security vulnerability CVE-2016-4970 for Netty mailing-list