CVE-2023-4586: Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack
Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's supported ecosystems. This link is maintained to preserve external references.
Original Description Netty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the 5.x release branch with no backport planned.
In the interim users are advised to enable host name validation in their configurations. See https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.
Other sources
A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.
The Infinispan / Data Grid Hot Rod client does not enable hostname validation when using TLS. This could cause a MITM attack.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-4586?
CVE-2023-4586 is a vulnerability in the Hot Rod client that allows man-in-the-middle attacks due to a lack of hostname validation.
How does CVE-2023-4586 impact Netty-handler?
CVE-2023-4586 affects Netty-handler by not validating hostnames when using TLS in its default configuration, making it vulnerable to man-in-the-middle attacks.
How can users mitigate the risk of CVE-2023-4586?
To mitigate the risk of CVE-2023-4586, users should set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to enable hostname validation.
Which software versions are affected by CVE-2023-4586?
CVE-2023-4586 affects Netty-handler versions 4.1.0.Final to 4.1.99.Final, Netty versions 4.1.0 to 4.1.99, Redhat Data Grid version 8.0.0, and Infinispan Hot Rod.
What is the severity of CVE-2023-4586?
The severity of CVE-2023-4586 is high, with a CVSS score of 7.4.