ALT-PU-2016-3291-1
Closed vulnerabilities
Published: 2014-05-06
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2014-0193
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
- http://netty.io/news/2014/04/30/release-day.html
- http://rhn.redhat.com/errata/RHSA-2014-1019.html
- http://rhn.redhat.com/errata/RHSA-2014-1020.html
- http://rhn.redhat.com/errata/RHSA-2014-1021.html
- http://rhn.redhat.com/errata/RHSA-2014-1351.html
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://secunia.com/advisories/58280
- http://secunia.com/advisories/59290
- http://www.securityfocus.com/bid/67182
- https://github.com/netty/netty/issues/2441
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
- http://netty.io/news/2014/04/30/release-day.html
- http://rhn.redhat.com/errata/RHSA-2014-1019.html
- http://rhn.redhat.com/errata/RHSA-2014-1020.html
- http://rhn.redhat.com/errata/RHSA-2014-1021.html
- http://rhn.redhat.com/errata/RHSA-2014-1351.html
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://secunia.com/advisories/58280
- http://secunia.com/advisories/59290
- http://www.securityfocus.com/bid/67182
- https://github.com/netty/netty/issues/2441
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
Published: 2014-07-31
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2014-3488
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
- http://netty.io/news/2014/06/11/3-9-2-Final.html
- http://secunia.com/advisories/59196
- https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994
- https://github.com/netty/netty/issues/2562
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
- http://netty.io/news/2014/06/11/3-9-2-Final.html
- http://secunia.com/advisories/59196
- https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994
- https://github.com/netty/netty/issues/2562
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
Published: 2017-10-18
Modified: 2025-04-20
Modified: 2025-04-20
CVE-2015-2156
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Severity: HIGH (7.5)Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html
- http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
- http://www.openwall.com/lists/oss-security/2015/05/17/1
- http://www.securityfocus.com/bid/74704
- https://bugzilla.redhat.com/show_bug.cgi?id=1222923
- https://github.com/netty/netty/pull/3754
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html
- http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
- http://www.openwall.com/lists/oss-security/2015/05/17/1
- http://www.securityfocus.com/bid/74704
- https://bugzilla.redhat.com/show_bug.cgi?id=1222923
- https://github.com/netty/netty/pull/3754
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
Published: 2022-05-13
Modified: 2024-04-16
Modified: 2024-04-16
GHSA-7vpq-g998-qpv7
Netty denial of service vulnerability
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-0193
- https://github.com/netty/netty/issues/2441
- https://github.com/netty/netty/commit/8599ab5bdb761bb99d41a975d689f74c12e4892b
- https://github.com/netty/netty
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
- https://web.archive.org/web/20140509033427/http://www.securityfocus.com/bid/67182
- https://web.archive.org/web/20140509044857/http://secunia.com/advisories/58280
- https://web.archive.org/web/20161119201425/http://secunia.com/advisories/59290
- http://netty.io/news/2014/04/30/release-day.html
- http://rhn.redhat.com/errata/RHSA-2014-1019.html
- http://rhn.redhat.com/errata/RHSA-2014-1020.html
- http://rhn.redhat.com/errata/RHSA-2014-1021.html
- http://rhn.redhat.com/errata/RHSA-2014-1351.html
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
Published: 2020-07-01
Modified: 2021-09-22
Modified: 2021-09-22
GHSA-9959-6p3m-wxpc
Denial of service in Netty
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-3488
- https://github.com/netty/netty/issues/2562
- https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994
- https://github.com/netty/netty
- https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
- https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSNETTY-31630
- http://netty.io/news/2014/06/11/3-9-2-Final.html
- http://secunia.com/advisories/59196
Published: 2020-07-01
Modified: 2021-09-22
Modified: 2021-09-22
GHSA-xfv3-rrfm-f2rv
Information Exposure in Netty
Severity: HIGH (7.5)Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-2156
- https://github.com/netty/netty/pull/3748/commits/4ac519f534493bb0ca7a77e1c779138a54faa7b9
- https://github.com/netty/netty/pull/3754
- https://github.com/netty/netty/commit/2caa38a2795fe1f1ae6ceda4d69e826ed7c55e55
- https://github.com/netty/netty/commit/31815598a2af37f0b71ea94eada70d6659c23752
- https://bugzilla.redhat.com/show_bug.cgi?id=1222923
- https://github.com/netty/netty
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/a19bb1003b0d6cd22475ba83c019b4fc7facfef2a9e13f71132529d3@%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/dc1275aef115bda172851a231c76c0932d973f9ffd8bc375c4aba769@%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E
- https://snyk.io/vuln/SNYK-JAVA-IONETTY-73571
- https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159379.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159166.html
- http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
- http://www.openwall.com/lists/oss-security/2015/05/17/1
- http://www.securityfocus.com/bid/74704