PT-2020-5478 · Netty+4 · Netty+4

Published 2020-04-07 · Updated 2024-06-15 · CVE-2020-11612

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.x through 4.1.45

Description The issue is related to the ZlibDecoders class in Netty, which allows for unbounded memory allocation while decoding a ZlibEncoded byte stream. This can be exploited by an attacker to impact the confidentiality, integrity, and availability of protected information by sending a large ZlibEncoded byte stream to the Netty server, forcing it to allocate all of its free memory to a single decoder.

Recommendations For Netty versions 4.1.x through 4.1.45, update to version 4.1.46 or later to resolve the issue. As a temporary workaround, consider restricting the size of incoming ZlibEncoded byte streams to prevent excessive memory allocation.

Exploit

Fix

Allocation of Resources Without Limits

Buffer Overflow

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-119

CWE-400

Related Identifiers

BDU:2021-00773

CVE-2020-11612

DLA-2364-1

DSA-4885-1

GHSA-MM9X-G8PC-W292

OPENSUSE-SU-2024:11085-1

RHSA-2020:2605

RHSA-2020:3461

RHSA-2020:3462

RHSA-2020:3463

RHSA-2021:1313

SUSE-SU-2022:3617-1

SUSE-SU-2022:3760-1

SUSE-SU-2022:3793-1

USN-4600-2

USN-6049-1

Affected Products

Astra Linux

Linuxmint

Netty

Suse

Ubuntu

References · 131

• 🔥 https://github.com/jdordonezn/CVE-2020-72381/issues/1 · Exploit
• https://github.com/netty/netty/pull/9924 · Patch
• https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final · Patch
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://ubuntu.com/security/CVE-2021-21295 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21290 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-20445 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11612 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3760-1 · Vendor Advisory
• https://oracle.com/security-alerts/cpuApr2021.html · Patch
• https://ubuntu.com/security/notices/USN-4600-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3793-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4600-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11612 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41915 · Vendor Advisory