PT-2017-8631 · Netty+1 · Netty+1

Scottmitch · Published 2017-04-13 · Updated 2022-05-13 · CVE-2016-4970

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Netty versions 4.0.x through 4.0.36.Final Netty versions 4.1.x through 4.1.0.Final

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop. This is due to a loop with an unreachable exit condition.

Recommendations For Netty versions 4.0.x through 4.0.36.Final, update to version 4.0.37.Final or later. For Netty versions 4.1.x through 4.1.0.Final, update to version 4.1.1.Final or later.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2016-4970

GHSA-RV63-GQM8-9W8Q

MGASA-2018-0485

Affected Products

Apache Cassandra

Netty

References · 23

• https://github.com/netty/netty/pull/5364 · Patch
• http://netty.io/news/2016/06/07/4-1-1-Final.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4970 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0179.html · Vendor Advisory
• http://netty.io/news/2016/06/07/4-0-37-Final.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4970 · Security Note
• http://rhn.redhat.com/errata/RHSA-2017-1097.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rv63-gqm8-9w8q · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0485.html · Security Note
• https://cve.org/CVERecord?id=CVE-2016-4970 · Security Note
• https://ubuntu.com/security/CVE-2016-4970 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4970 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0485 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4970 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4970 · Vendor Advisory