REDHAT-BUG-2488081: High severity maven/io.netty/netty-handler vulnerability
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
netty/netty-handlerto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
netty/netty-handlerto a version that resolves this vulnerability.Fixed in 4.2.15.Final
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments using netty-handler with IPv6 subnet rules are exposed, because the affected comparison operation can allow valid public IP addresses to bypass those restrictions.
What does an attacker need to exploit this issue?
The attacker needs a valid public IP address that is evaluated against an affected IPv6 subnet rule. The flaw allows the address to bypass the intended restriction.
How can I determine whether my application is affected?
Check the resolved version of the maven/io.netty/netty-handler dependency and whether the application uses IPv6 subnet filtering. Versions earlier than 4.1.135.Final or 4.2.15.Final are affected.
What version should be deployed to remediate the issue?
Upgrade netty-handler to 4.1.135.Final or 4.2.15.Final, which patch the incorrect masking operation.