REDHAT-BUG-2505980: High severity Netty Netty vulnerability
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(...) calls decompressor.writeInbound(data.retain()) and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.136.Final - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2505980?
The severity of REDHAT-BUG-2505980 is classified as high with a score of 7.
What systems are affected by REDHAT-BUG-2505980?
REDHAT-BUG-2505980 affects versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final of the Netty framework.
How do I fix REDHAT-BUG-2505980?
To fix REDHAT-BUG-2505980, upgrade to a patched version of Netty that is not vulnerable to the described issue.
What type of vulnerability is REDHAT-BUG-2505980?
REDHAT-BUG-2505980 is a vulnerability that allows a remote unauthenticated peer to leak a direct ByteBuf per HTTP/2 DATA frame.
Can REDHAT-BUG-2505980 be exploited remotely?
Yes, REDHAT-BUG-2505980 can be exploited by a remote unauthenticated peer due to its nature.