REDHAT-BUG-2505698: High severity Netty Netty vulnerability
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by reading the 13th byte as a signed Java byte and widening it to int without masking; a PROXY protocol v2 binary prefix followed by version byte 0xFF sign-extends to -1, collides with the decoder's need-more-data sentinel, and causes ByteToMessageDecoder to accumulate inbound bytes in an unbounded cumulation buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netty codec-haproxy (HAProxyMessageDecoder)to a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Netty codec-haproxy (HAProxyMessageDecoder)to a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What are the affected versions in REDHAT-BUG-2505698?
Affected versions include Netty 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135.
What is the severity level of REDHAT-BUG-2505698?
The severity level of REDHAT-BUG-2505698 is classified as high with a score of 7.
How can I fix REDHAT-BUG-2505698?
To fix REDHAT-BUG-2505698, upgrade to Netty versions 4.2.16.Final or later, and 4.1.135 or later.
Does REDHAT-BUG-2505698 impact security?
Yes, REDHAT-BUG-2505698 has a high severity level indicating potential security implications.
What is the main issue described in REDHAT-BUG-2505698?
The main issue involves a flaw in the `HAProxyMessageDecoder` of Netty's `codec-haproxy` module regarding protocol version detection.