Resource exhaustion in Netty - CVE-2023-34462

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU77573

Resource exhaustion in Netty - CVE-2023-34462

Published: June 20, 2023


Vulnerability identifier: #VU77573
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-34462
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources if no idle timeout handler was configured. A remote attacker can send a client hello packet, which leads the server to buffer up to 16MB of data per connection and results in a denial of service condition.


Affected software

Netty
Debian Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
Cloud Pak for Network Automation
Event Processing
DataPower Operations Dashboard
DataStax Hyper-Converged Database
Oracle Utilities Network Management System
Cognos Dashboards on Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Oracle Business Intelligence Enterprise Edition
Db2 Big SQL
IBM OpenPages with Watson
IBM Event Endpoint Management
dashDB Local
Oracle Communications Network Charging and Control
Oracle FLEXCUBE Universal Banking
Oracle Banking Digital Experience
IBM Application Suite - IBM Asset Data Dictionary Component
ObjectScale
IBM Planning Analytics Workspace
Storage Defender Copy Data Management
Dell EMC PowerStore Family Operating System
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
IBM QRadar Incident Forensics
MobileFirst Platform
IBM Business Automation Manager Open Editions
Storage Protect Server
IBM Observability with Instana
IBM Operations Analytics Predictive Insights
Red Hat Integration Camel-K
Oracle Banking Party Management
Oracle Banking Deposits and Lines of Credit Servicing
Red Hat Integration Camel Extensions for Quarkus
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Intelligent Operations Center
WebSphere Remote Server
Oracle Communications Session Report Manager
IBM Security Verify Governance
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Network Analytics Data Director
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Operations Dashboard
Log Analysis
PowerVC
Cryostat
IBM Spectrum Conductor
Red Hat Integration - Service Registry
Red Hat build of Quarkus
IBM MaaS360 Cloud Extender Agent
IBM MaaS360 Mobile Enterprise Gateway
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Tivoli Business Service Manager
IBM Maximo Asset Management
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
AMQ Clients
JBoss Enterprise Application Platform
AMQ Broker
Oracle Coherence
AMQ Streams
JBoss Data Grid
IBM Qradar SIEM
Event Streams
PeopleSoft Enterprise PeopleTools
Operational Decision Manager
IBM Cognos Analytics
IBM DB2
IBM InfoSphere Information Server
Oracle TimesTen In-Memory Database
Oracle NoSQL Database
Oracle Communications Convergent Charging Controller
Oracle WebCenter Portal
Oracle Banking Credit Facilities Process Management
Oracle Banking Supply Chain Finance
Oracle Banking Virtual Account Management
Oracle Banking Liquidity Management
Oracle Banking Trade Finance Process Management
Oracle Banking Origination
Oracle Banking Electronic Data Exchange for Corporates
Oracle Banking Cash Management
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
eap7 (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-jboss-modules (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
netty-tcnative
netty-tcnative-javadoc
eap7-undertow (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-resteasy (Red Hat package)
netty (Debian package)
libnetty-java (Ubuntu package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
netty-poms
netty
netty-javadoc
eap7-hibernate (Red Hat package)
eap7-wildfly (Red Hat package)
Voice Gateway
IBM Disconnected Log Collector
watsonx.data
IBM Cloud Pak System
IBM MaaS360 VPN Module
Red Hat Camel for Spring Boot
IBM Security Verify Access

How to mitigate CVE-2023-34462

Install updates from vendor's website.

Netty - update to 4.1.94
Event Processing - update to 1.0.3
DataPower Operations Dashboard - update to 1.0.20.0
DataStax Hyper-Converged Database - update to 1.2.5
IBM Operations Analytics Predictive Insights - update to 1.3.6.8
Red Hat Integration Camel-K - update to 1.10.5
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.9
Cognos Dashboards on Cloud Pak for Data - update to 4.8.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
Db2 Big SQL - update to 7.6.2
JBoss Enterprise Application Platform - update to 7.4.13
AMQ Broker - update to 7.11.3
JBoss Data Grid - update to 8.4.4
IBM Event Endpoint Management - update to 11.0.3
dashDB Local - update to 11.5.9.0
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 2
Oracle TimesTen In-Memory Database - addressed in versions 18.1.4.39.0, 22.1.1.18.0
Oracle NoSQL Database - addressed in versions 19.5.40, 20.3.38, 21.2.30, 22.3.94, 23.1.29
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 38.0
Operations Dashboard - update to 2022.2.1-15-lts
eap7 (Red Hat package) - addressed in versions mod_cluster-1.4.5-1.Final_redhat_00001.1.el7eap, mod_cluster-1.4.5-1.Final_redhat_00001.1.el8eap, mod_cluster-1.4.5-1.Final_redhat_00001.1.el9eap
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.10
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.6
Log Analysis - update to 1.3.8 Fix Pack 1
ObjectScale - update to 1.4.0
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.15-1.Final_redhat_00001.1.el7eap, 1.5.15-1.Final_redhat_00001.1.el8eap, 1.5.15-1.Final_redhat_00001.1.el9eap
IBM Disconnected Log Collector - update to 1.8.5
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-31.Final_redhat_00030.1.el7eap, 1.10.0-31.Final_redhat_00030.1.el8eap, 1.10.0-31.Final_redhat_00030.1.el9eap
eap7-jboss-modules (Red Hat package) - addressed in versions 1.12.2-1.Final_redhat_00001.1.el7eap, 1.12.2-1.Final_redhat_00001.1.el8eap, 1.12.2-1.Final_redhat_00001.1.el9eap
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.20-1.Final_redhat_00001.1.el7eap, 1.15.20-1.Final_redhat_00001.1.el8eap, 1.15.20-1.Final_redhat_00001.1.el9eap
eap7-bouncycastle (Red Hat package) - addressed in versions 1.76.0-4.redhat_00001.1.el7eap, 1.76.0-4.redhat_00001.1.el8eap, 1.76.0-4.redhat_00001.1.el9eap
watsonx.data - update to 2.0.3
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.13-2.SP1_redhat_00001.1.el7eap, 2.0.13-2.SP1_redhat_00001.1.el8eap, 2.0.13-2.SP1_redhat_00001.1.el9eap
netty-tcnative - update to 2.0.61-150200.3.13.1
netty-tcnative-javadoc - update to 2.0.61-150200.3.13.1
IBM Planning Analytics Workspace - update to 2.0.91
PowerVC - addressed in versions 2.1.1.2, 2.3.0
eap7-undertow (Red Hat package) - addressed in versions 2.2.26-1.SP1_redhat_00001.1.el7eap, 2.2.26-1.SP1_redhat_00001.1.el8eap, 2.2.26-1.SP1_redhat_00001.1.el9eap
Storage Defender Copy Data Management - update to 2.2.28.0
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
Cryostat - update to 2.4.0
AMQ Streams - update to 2.5.0
IBM Spectrum Conductor - update to 2.5.1 Fix 601861
Red Hat Integration - Service Registry - update to 2.5.4
Red Hat build of Quarkus - update to 2.13.9
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-15.redhat_00049.1.el7eap, 2.16.0-15.redhat_00049.1.el8eap, 2.16.0-15.redhat_00049.1.el9eap
IBM MaaS360 Cloud Extender Agent - update to 3.000.300.025
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.400
IBM MaaS360 VPN Module - update to 3.000.400
eap7-hal-console (Red Hat package) - addressed in versions 3.3.19-1.Final_redhat_00001.1.el7eap, 3.3.19-1.Final_redhat_00001.1.el8eap, 3.3.19-1.Final_redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.7.0
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.10-1.Final_redhat_00001.1.el7eap, 3.8.10-1.Final_redhat_00001.1.el8eap, 3.8.10-1.Final_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package) - addressed in versions 3.15.8-1.Final_redhat_00001.1.el7eap, 3.15.8-1.Final_redhat_00001.1.el8eap, 3.15.8-1.Final_redhat_00001.1.el9eap
Red Hat Camel for Spring Boot - update to 4.0.0
Dell EMC PowerStore Family Operating System - update to 4.0.0.0-2284811
QRadar User Behavior Analytics - update to 4.1.16
netty (Debian package) - addressed in versions 1:4.1.48-4+deb11u2, 1:4.1.48-7+deb12u1
libnetty-java (Ubuntu package) - update to 1:4.1.48-4+deb11u2build0.22.04.1
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.94-1.Final_redhat_00001.1.el7eap, 4.1.94-1.Final_redhat_00001.1.el8eap, 4.1.94-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.94-1.Final_redhat_00001.1.el7eap, 4.1.94-1.Final_redhat_00001.1.el8eap, 4.1.94-1.Final_redhat_00001.1.el9eap
netty-poms - update to 4.1.94-150200.4.17.1
netty - update to 4.1.94-150200.4.17.1
netty-javadoc - update to 4.1.94-150200.4.17.1
IBM Cloud Pak for Watson AIOps - update to 4.2.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.4
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
eap7-hibernate (Red Hat package) - addressed in versions 5.3.31-1.Final_redhat_00001.1.el7eap, 5.3.31-1.Final_redhat_00001.1.el8eap, 5.3.31-1.Final_redhat_00001.1.el9eap
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
IBM Tivoli Business Service Manager - update to 6.2.0.5.4
eap7-wildfly (Red Hat package) - addressed in versions 7.4.13-8.GA_redhat_00001.1.el7eap, 7.4.13-8.GA_redhat_00001.1.el8eap, 7.4.13-8.GA_redhat_00001.1.el9eap
IBM QRadar Incident Forensics - update to 7.5.0 UP10 IF02
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF02
IBM Maximo Asset Management - addressed in versions 7.6.1.2.36, 7.6.1.3.11
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202309071046
IBM Business Automation Manager Open Editions - update to 8.0.6
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.22
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4, 8.10.9, 8.11.6
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 49, 8.11.0.1 Interim fix 26, 8.12.0 Interim fix 8
IBM Security Verify Access - update to 10.0.7.0
IBM Cognos Analytics - addressed in versions 11.2.4 FP3, 12.0.3
Event Streams - update to 11.4.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.30, 23.0.2.2
AMQ Clients - update to 2023.Q4

External References

Related Security Bulletins