Resource management error in Netty - CVE-2024-47535

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU100259

Resource management error in Netty - CVE-2024-47535

Published: November 12, 2024 / Updated: February 11, 2025


Vulnerability identifier: #VU100259
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-47535
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an unsafe reading of an environment file on Windows. A local user can create an overly large file and perform a denial of service (DoS) attack.


Affected software

Netty
SUSE Manager Server 4.3
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Linux Enterprise Micro
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Storage Protect for Virtual Environments: Data Protection for VMware
Astronomer with IBM
Netezza Appliance
Operations Analytics - Log Analysis
PowerVM NovaLink
Guardium Data Security Center (GDSC)
Security QRadar EDR
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Data Product Hub
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Db2 Big SQL
IBM Business Automation Manager Open Editions
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Backup-Archive Client
Storage Protect for Space Management
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Maximo Application Suite - Predict Component
Business Automation Insights
IBM Application Suite - IBM Asset Data Dictionary Component
Event Processing
User Entity Behavior Analytics
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Storage Protect Operations Center
Maximo Application Suite - IoT Component
DevOps Test Workbench
IBM Event Endpoint Management
Guardium Data Protection
IBM Operator for Apache Flink
IBM Decision Optimization for Cloud Pak for Data
Log Analysis
Netcool Operations Insight
IBM Fusion HCI
IBM SPSS Analytic Server
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Connect:Direct Web Services
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
IBM Maximo Application Suite - AI Broker
IBM SPSS Modeler
IBM Robotic Process Automation
IBM Automation Decision Services
IBM Business Automation Workflow
IBM Cloud Pak for Security
IBM Process Mining
Red Hat Integration Camel Extensions for Quarkus
IBM Watson Discovery for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM TXSeries for Multiplatforms
WebSphere eXtreme Scale
IBM Maximo Application Suite - Manage Component
Rational Test Workbench
IBM Cloud Pak for Business Automation
IBM Observability with Instana
IBM DB2
Voice Gateway
Communications Service Catalog and Design
watsonx.data
IBM Sterling File Gateway
IBM Tivoli Application Dependency Discovery Manager
JBoss Enterprise Application Platform
AMQ Streams
IBM WebSphere Application Server Liberty
Event Streams
Informix Dynamic Server
Oracle Hospitality Cruise Shipboard Property Management System
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap8-slf4j (Red Hat package)
netty-tcnative-javadoc
netty-tcnative
eap7-apache-commons-io (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-hal-console (Red Hat package)
jctools-experimental
jctools-channels
jctools-javadoc
jctools
netty
netty-javadoc
eap8-netty-transport-native-epoll (Red Hat package)
eap8-netty (Red Hat package)
susemanager-sync-data
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Operational Decision Manager
IBM CICS TX Advanced
IBM CICS TX Standard

How to mitigate CVE-2024-47535

Install updates from vendor's website.

Netty - update to 4.1.115
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.27.0
IBM Operator for Apache Flink - update to 1.4.5
Astronomer with IBM - update to 1.0.1
Netezza Appliance - update to 1.0.0.1
Voice Gateway - update to 1.0.8.19
Operations Analytics - Log Analysis - update to 1.3.8.4
Netcool Operations Insight - update to 1.6.15
PowerVM NovaLink - addressed in versions 2.1.1-250528, 2.2.1.1-250529, 2.3.0.1-250610
watsonx.data - update to 2.2
IBM Fusion HCI - update to 2.10.0
Guardium Data Security Center (GDSC) - update to 3.6.1
Security QRadar EDR - update to 3.12.15
IBM Cloud Pak for Watson AIOps - update to 4.10.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Knowledge Catalog Premium Cartridge - update to 5.2
Data Product Hub - update to 5.2.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
IBM Sterling File Gateway - addressed in versions 6.1.2.7.1, 6.2.0.5, 6.2.1.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.7.1, 6.2.0.5, 6.2.1.1
IBM Sterling Connect:Direct Web Services - addressed in versions 6.2.0.27, 6.3.0.2
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Spectrum Symphony - update to 7.3.2 FP3
JBoss Enterprise Application Platform - addressed in versions 7.4.21, 7.4.22, 8.0.6
Db2 Big SQL - update to 8.0
IBM Business Automation Manager Open Editions - update to 8.0.7
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.27.0
Storage Protect Backup-Archive Client - update to 8.1.27
Storage Protect for Space Management - update to 8.1.27.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Maximo Application Suite - Monitor Component - addressed in versions 8.10.16, 8.11.14, 9.0.6
IBM Maximo Application Suite - addressed in versions 8.10.25, 8.11.22, 9.0.11
Maximo Application Suite - Predict Component - update to 9.0.5
IBM Maximo Application Suite - AI Broker - update to 9.0.4
Event Streams - update to 11.8.1
IBM Robotic Process Automation - addressed in versions 21.0.7.21, 23.0.20.2
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
Event Processing - update to 1.4.1
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.19-1.Final_redhat_00001.1.el7eap, 1.5.19-1.Final_redhat_00001.1.el8eap, 1.5.19-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-41.Final_redhat_00041.1.el7eap, 1.10.0-41.Final_redhat_00041.1.el8eap, 1.10.0-41.Final_redhat_00041.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.25-1.Final_redhat_00001.1.el7eap, 1.15.25-1.Final_redhat_00001.1.el8eap, 1.15.25-1.Final_redhat_00001.1.el9eap
AMQ Streams - update to 2
IBM Process Mining - update to 2.0.0 IF001
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-2.redhat_00003.1.el8eap, 2.0.16-2.redhat_00003.1.el9eap
netty-tcnative-javadoc - update to 2.0.69-150200.3.22.1
netty-tcnative - update to 2.0.69-150200.3.22.1
eap7-apache-commons-io (Red Hat package) - addressed in versions 2.16.1-1.redhat_00001.1.el7eap, 2.16.1-1.redhat_00001.1.el8eap, 2.16.1-1.redhat_00001.1.el9eap
eap7-weld-core (Red Hat package) - addressed in versions 3.1.11-1.Final_redhat_00001.1.el7eap, 3.1.11-1.Final_redhat_00001.1.el8eap, 3.1.11-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.26-1.Final_redhat_00001.1.el7eap, 3.3.26-1.Final_redhat_00001.1.el8eap, 3.3.26-1.Final_redhat_00001.1.el9eap
Red Hat Integration Camel Extensions for Quarkus - update to 3.15.3
jctools-experimental - update to 4.0.5-150200.3.9.1
jctools-channels - update to 4.0.5-150200.3.9.1
jctools-javadoc - update to 4.0.5-150200.3.9.1
jctools - update to 4.0.5-150200.3.9.1
netty - addressed in versions 4.1.44.Final-150400.3.6.3, 4.1.115-150200.4.26.1
netty-javadoc - update to 4.1.115-150200.4.26.1
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
susemanager-sync-data - update to 4.3.23-150400.3.41.3
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
User Entity Behavior Analytics - update to 5.0.2
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.31-1.Final_redhat_00001.1.el7eap, 5.0.31-1.Final_redhat_00001.1.el8eap, 5.0.31-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0
watsonx Assistant Cartridge - update to 5.3.0
Dell Secure Connect Gateway - update to 5.28.00.14
eap7-wildfly (Red Hat package) - addressed in versions 7.4.22-2.GA_redhat_00001.1.el7eap, 7.4.22-2.GA_redhat_00001.1.el8eap, 7.4.22-2.GA_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.6-15.GA_redhat_00009.1.el8eap, 8.0.6-15.GA_redhat_00009.1.el9eap
Storage Protect Operations Center - update to 8.1.27
IBM TXSeries for Multiplatforms - addressed in versions 8.2.0.3, 9.1.0.3, 10.1.0.0, 11.1.0.0 ifix4
WebSphere eXtreme Scale - update to 8.6.1.6 PH65615 iFix
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.26, 8.7.20, 9.0.13
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 039, 8.11.1 Interim fix 34, 8.12.0.1 Interim fix 18, 9.0.0.1 Interim fix 2
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix37, 11.1.0.0 ifix29
Rational Test Workbench - addressed in versions 10.2.3, 10.5.4
DevOps Test Workbench - update to 11.0.4
IBM CICS TX Standard - update to 11.1.0.0 ifix30
IBM Event Endpoint Management - update to 11.4.2
Guardium Data Protection - update to 12.0p40
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
IBM WebSphere Application Server Liberty - update to 25.0.0.2
IBM Observability with Instana - update to 287
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.6.1-1.GA_redhat_00001.1.el8eap, 800.6.1-1.GA_redhat_00001.1.el9eap

External References

Related Security Bulletins