Infinite loop in Netty - CVE-2022-41881

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU70118

Infinite loop in Netty - CVE-2022-41881

Published: December 12, 2022 / Updated: July 18, 2024


Vulnerability identifier: #VU70118
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-41881
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the HaProxyMessageDecoder when parsing a TLV with type of "PP2_TYPE_SSL". A remote attacker can pass a specially crafted message to consume all available system resources and cause denial of service conditions.


Affected software

Netty
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
IBM Transparent Cloud Tiering
Oracle Utilities Network Management System
Oracle Banking Platform
DataStage on Cloud Pak for Data
Oracle Communications Network Charging and Control
Oracle FLEXCUBE Universal Banking
Oracle Banking Digital Experience
Db2 Graph
DataPower Operations Dashboard
IBM Planning Analytics Workspace
Cloud Pak for Network Automation
IBM MaaS360 Base Module
MaaS360 Configuration Utility
MaaS360 PKI Certificate Module
PowerStore T
IBM QRadar Incident Forensics
Dell Data Protection Central
IBM Observability with Instana
Migration Toolkit for Runtimes
IBM Process Mining
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Network Analytics Data Director
Netcool Operations Insight
Red Hat Integration Camel Extensions for Quarkus
Red Hat build of Quarkus
IBM MaaS360 Mobile Enterprise Gateway
IBM MaaS360 Cloud Extender Agent
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
Red Hat Migration Toolkit for Applications
IBM Maximo Asset Management
Operations Dashboard
IBM Cloud Pak for Multicloud Management
IBM Disconnected Log Collector
Red Hat build of Eclipse Vert.x
Oracle Utilities Testing Accelerator
Oracle Banking Corporate Lending Process Management
Oracle Banking Trade Finance Process Management
Oracle Banking Liquidity Management
Oracle Banking Branch
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
JBoss Enterprise Application Platform
Oracle Coherence
Fuse
Red Hat Single Sign-On
Oracle Communications Instant Messaging Server
JBoss Data Grid
IBM Qradar SIEM
PeopleSoft Enterprise PeopleTools
IBM Cognos Analytics
Oracle Commerce Guided Search
Oracle Communications BRM - Elastic Charging Engine
Oracle Database Server
Oracle Communications Convergent Charging Controller
Oracle WebCenter Portal
Oracle Communications Cloud Native Core Console
libnetty-java (Ubuntu package)
eap7-jboss-el (Red Hat package)
eap7-apache-mime4j (Red Hat package)
eap7-activemq-artemis-native (Red Hat package)
eap7-artemis-native (Red Hat package)
eap7-artemis-wildfly-integration (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-velocity (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-undertow-jastow (Red Hat package)
netty-tcnative
netty-tcnative-javadoc
eap7-undertow (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jbossws-spi (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
netty-help
netty
netty (Debian package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
netty-poms
netty-javadoc
eap7-jbossws-cxf (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
rh-sso7-keycloak (Red Hat package)
Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1
Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1
Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1
Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1
Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1
Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1
Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1
Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1
Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1
Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1
Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1
Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1
Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1
Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1
watsonx.data
IBM MaaS360 VPN Module
Red Hat Camel for Spring Boot

How to mitigate CVE-2022-41881

Install updates from vendor's website.

Netty - update to 4.1.86
Migration Toolkit for Runtimes - update to 1.1.0
IBM Transparent Cloud Tiering - update to 1.1.8.5
IBM Process Mining - update to 1.14.0.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Red Hat build of Eclipse Vert.x - update to 4.3.7
DataStage on Cloud Pak for Data - update to 4.8.5
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12, 7.4.10
Red Hat Single Sign-On - update to 7.6.3
JBoss Data Grid - update to 8.4.1
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
libnetty-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1:4.1.48-4+deb11u1build0.22.04.1, 1:4.1.48-5ubuntu0.1
eap7-jboss-el (Red Hat package) - addressed in versions api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el9eap
eap7-apache-mime4j (Red Hat package) - addressed in versions 0.8.9-1.redhat_00001.1.el7eap, 0.8.9-1.redhat_00001.1.el8eap, 0.8.9-1.redhat_00001.1.el9eap
Db2 Graph - addressed in versions 1.0.0.1562-amd64, 1.0.0.1562-s390x, 1.0.0.1562-ppcle, 1.0.0.1598-amd64, 1.0.0.1598-s390x, 1.0.0.1598-ppcle
eap7-activemq-artemis-native (Red Hat package) - addressed in versions 1.0.2-3.redhat_00004.1.el7eap, 1.0.2-3.redhat_00004.1.el8eap, 1.0.2-3.redhat_00004.1.el9eap
eap7-artemis-native (Red Hat package) - addressed in versions 1.0.2-4.redhat_00004.1.el7eap, 1.0.2-4.redhat_00004.1.el8eap, 1.0.2-4.redhat_00004.1.el9eap
eap7-artemis-wildfly-integration (Red Hat package) - addressed in versions 1.0.7-1.redhat_00001.1.el7eap, 1.0.7-1.redhat_00001.1.el8eap, 1.0.7-1.redhat_00001.1.el9eap
DataPower Operations Dashboard - update to 1.0.19.0
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00002.1.el7eap, 1.1.16-1.Final_redhat_00002.1.el8eap, 1.1.16-1.Final_redhat_00002.1.el9eap
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-2.redhat_00002.1.el7eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.11-1.Final_redhat_00001.1.el7eap, 1.5.11-1.Final_redhat_00001.1.el8eap, 1.5.11-1.Final_redhat_00001.1.el9eap
Netcool Operations Insight - update to 1.6.10
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-26.Final_redhat_00025.1.el7eap, 1.10.0-26.Final_redhat_00025.1.el8eap, 1.10.0-26.Final_redhat_00025.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7, 1.33.0-2.SP1_redhat_00001.1.el7eap, 1.33.0-2.SP1_redhat_00001.1.el8eap, 1.33.0-2.SP1_redhat_00001.1.el9eap
watsonx.data - addressed in versions 2.0.2, 2.0.3
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.14-1.Final_redhat_00001.1.el7eap, 2.0.14-1.Final_redhat_00001.1.el8eap, 2.0.14-1.Final_redhat_00001.1.el9eap
netty-tcnative - update to 2.0.59-150200.3.10.1
netty-tcnative-javadoc - update to 2.0.59-150200.3.10.1
IBM Planning Analytics Workspace - update to 2.0.83
eap7-undertow (Red Hat package) - addressed in versions 2.2.23-1.SP2_redhat_00001.1.el7eap, 2.2.23-1.SP2_redhat_00001.1.el8eap, 2.2.23-1.SP2_redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.4.5
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-22.SP12_redhat_00012.1.el7eap, 2.5.5-22.SP12_redhat_00012.1.el8eap, 2.5.5-22.SP12_redhat_00012.1.el9eap
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap
eap7-jackson-jaxrs-providers (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-java8 (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-core (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-annotations (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-4.redhat_00004.1.el7eap
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.2-1
Red Hat build of Quarkus - update to 2.13.7
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap, 3.15.5-1.Final_redhat_00001.1.el7eap, 3.15.5-1.Final_redhat_00001.1.el8eap, 3.15.5-1.Final_redhat_00001.1.el9eap
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.100
IBM MaaS360 VPN Module - update to 3.000.100
IBM MaaS360 Base Module - update to 3.000.100
MaaS360 Configuration Utility - update to 3.000.100
MaaS360 PKI Certificate Module - update to 3.000.100
IBM MaaS360 Cloud Extender Agent - update to 3.000.100.069
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
eap7-hal-console (Red Hat package) - update to 3.2.17-1.Final_redhat_00001.1.el7eap
eap7-jbossws-spi (Red Hat package) - addressed in versions 3.4.0-2.Final_redhat_00001.1.el7eap, 3.4.0-2.Final_redhat_00001.1.el8eap, 3.4.0-2.Final_redhat_00001.1.el9eap
PowerStore T - update to 3.5.0.1-2083289
Red Hat Camel for Spring Boot - update to 3.20.1
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.50-1.Final_redhat_00001.1.el7eap, 4.0.50-1.Final_redhat_00001.1.el8eap, 4.0.50-1.Final_redhat_00001.1.el9eap
QRadar User Behavior Analytics - update to 4.1.12
netty-help - addressed in versions 4.1.13-18, 4.1.13-20, 4.1.13-21
netty - addressed in versions 4.1.13-18, 4.1.13-20, 4.1.13-21
netty (Debian package) - update to 1:4.1.48-4+deb11u1
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
netty - update to 4.1.90-150200.4.14.1
netty-poms - update to 4.1.90-150200.4.14.1
netty-javadoc - update to 4.1.90-150200.4.14.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.8-1.Final_redhat_00001.1.el7eap, 5.4.8-1.Final_redhat_00001.1.el8eap, 5.4.8-1.Final_redhat_00001.1.el9eap
Red Hat Migration Toolkit for Applications - update to 6.2.0
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap, 7.4.10-6.GA_redhat_00002.1.el7eap, 7.4.10-6.GA_redhat_00002.1.el8eap, 7.4.10-6.GA_redhat_00002.1.el9eap
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
IBM Maximo Asset Management - update to 7.6.1.3.16
Fuse - update to 7.12.0
eap7-infinispan (Red Hat package) - addressed in versions 11.0.17-1.Final_redhat_00001.1.el7eap, 11.0.17-1.Final_redhat_00001.1.el8eap, 11.0.17-1.Final_redhat_00001.1.el9eap
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 7, 11.2.4.1 IF1
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.4.0-1.Final_redhat_00001.1.el7eap, 13.4.0-1.Final_redhat_00001.1.el8eap, 13.4.0-1.Final_redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.7-1.redhat_00001.1.el7sso, 18.0.7-1.redhat_00001.1.el8sso, 18.0.7-1.redhat_00001.1.el9sso
Dell Data Protection Central - update to 19.11.0-2
Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1 - update to 76-Final.html
Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1 - update to 77-Final.html
Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1 - update to 78-Final.html
Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1 - update to 79-Final.html
Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1 - update to 80-Final.html
Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1 - update to 81-Final.html
Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1 - update to 82-Final.html
Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1 - update to 84-Final.html
Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1 - update to 85-Final.html
Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1 - update to 86-Final.html
Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1 - update to 87-Final.html
Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1 - update to 88-Final.html
Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1 - update to 89-Final.html
Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1 - update to 90-Final.html
Operations Dashboard - update to 2022.2.1-8-lts

External References

Related Security Bulletins