Resource exhaustion in Netty - CVE-2023-34462

Vulnerability identifier: #VU77573

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-34462

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Netty
Debian Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
Cloud Pak for Network Automation
Event Processing
DataPower Operations Dashboard
DataStax Hyper-Converged Database
Oracle Utilities Network Management System
Cognos Dashboards on Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Oracle Business Intelligence Enterprise Edition
Db2 Big SQL
IBM OpenPages with Watson
IBM Event Endpoint Management
dashDB Local
Oracle Communications Network Charging and Control
Oracle FLEXCUBE Universal Banking
Oracle Banking Digital Experience
IBM Application Suite - IBM Asset Data Dictionary Component
ObjectScale
IBM Planning Analytics Workspace
Storage Defender Copy Data Management
Dell EMC PowerStore Family Operating System
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
IBM QRadar Incident Forensics
MobileFirst Platform
IBM Business Automation Manager Open Editions
Storage Protect Server
IBM Observability with Instana
IBM Operations Analytics Predictive Insights
Red Hat Integration Camel-K
Oracle Banking Party Management
Oracle Banking Deposits and Lines of Credit Servicing
Red Hat Integration Camel Extensions for Quarkus
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Intelligent Operations Center
WebSphere Remote Server
Oracle Communications Session Report Manager
IBM Security Verify Governance
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Network Analytics Data Director
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Operations Dashboard
Log Analysis
PowerVC
Cryostat
IBM Spectrum Conductor
Red Hat Integration - Service Registry
Red Hat build of Quarkus
IBM MaaS360 Cloud Extender Agent
IBM MaaS360 Mobile Enterprise Gateway
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Tivoli Business Service Manager
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
AMQ Clients
JBoss Enterprise Application Platform
AMQ Broker
Oracle Coherence
AMQ Streams
JBoss Data Grid
IBM Qradar SIEM
Event Streams
PeopleSoft Enterprise PeopleTools
Operational Decision Manager
IBM Cognos Analytics
IBM DB2
IBM InfoSphere Information Server
Oracle TimesTen In-Memory Database
Oracle NoSQL Database
Oracle Communications Convergent Charging Controller
Oracle WebCenter Portal
Oracle Banking Credit Facilities Process Management
Oracle Banking Supply Chain Finance
Oracle Banking Virtual Account Management
Oracle Banking Liquidity Management
Oracle Banking Trade Finance Process Management
Oracle Banking Origination
Oracle Banking Electronic Data Exchange for Corporates
Oracle Banking Cash Management
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
eap7 (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
netty-tcnative
netty-tcnative-javadoc
eap7-undertow (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-resteasy (Red Hat package)
netty (Debian package)
libnetty-java (Ubuntu package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
netty-poms
netty
netty-javadoc
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
Voice Gateway
IBM Disconnected Log Collector
watsonx.data
IBM Cloud Pak System
IBM MaaS360 VPN Module
Red Hat Camel for Spring Boot
IBM Security Verify Access

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources if no idle timeout handler was configured. A remote attacker can send a client hello packet, which leads the server to buffer up to 16MB of data per connection and results in a denial of service condition.

Install updates from vendor's website.

• https://github.com/netty/netty/security/advisories/GHSA-6mjq-h674-j845