CVE-2016-4970: High severity Netty Netty vulnerability
Due to a bug in handling return code from openssl native calls, the SslHandler that uses OpenSslEngine can end up in an infinite loop and eat up all CPU cycles, which may lead to DoS of the system.
This can only happen if the server has renegotiation enabled (which is set as default). Only systems using SslProvider.OpenSsl are affected, that will be true if netty-tcnative is in the classpath and openssl is installed.
If netty-tcnative is linked against boringssl, the problem does not exist, since renegotiation is not supported in boringssl.
Versions affected: Netty 4.0.0.Final - 4.0.36.Final and 4.1.0.Final
Workaround:
Users can use -Djdk.tls.rejectClientInitiatedRenegotiation=true to disable renegotiation and avoid this issue.
Other sources
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-4970?
CVE-2016-4970 is classified as a denial of service vulnerability, which can lead to an infinite loop in affected Netty versions.
How do I fix CVE-2016-4970?
To fix CVE-2016-4970, upgrade to Netty version 4.0.37.Final or 4.1.1.Final and ensure no older versions are in use.
Which versions are affected by CVE-2016-4970?
CVE-2016-4970 affects Netty versions prior to 4.0.37.Final and 4.1.1.Final.
Can CVE-2016-4970 be exploited remotely?
Yes, CVE-2016-4970 allows remote attackers to exploit the vulnerability and cause a denial of service.
What software packages contain CVE-2016-4970?
CVE-2016-4970 is found in the io.netty:netty-handler package among others.