Information disclosure in Netty - CVE-2024-29025

Vulnerability identifier: #VU87779

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29025

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in HttpPostRequestDecoder. A remote attacker can gain unauthorized access to sensitive information on the system.

Netty
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Package Hub 15
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
DataPower Operations Dashboard
Oracle Banking Platform
Oracle Utilities Network Management System
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Db2 Big SQL
IBM OpenPages with Watson
Datacap
Oracle FLEXCUBE Universal Banking
Oracle Retail Xstore Point of Service
IBM Application Suite - IBM Asset Data Dictionary Component
IBM Cloud Pak for Watson AIOps
watsonx Assistant for IBM Cloud Pak for Data
DataStage on Cloud Pak for Data
User Entity Behavior Analytics
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
DevOps Deploy
Storage Protect Server
Storage Virtualize
Maximo Application Suite - Monitor Component
Telco Service Activator
IBM Event Endpoint Management
Business Automation Insights
IBM Process Mining
Oracle Communications Converged Charging System
Cryostat
IBM Cloud Transformation Advisor
IBM SPSS Analytic Server
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Sterling B2B Integrator
WebSphere Remote Server
IBM Security Verify Governance
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
Enterprise Manager Base Platform
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Exposure Function
Migration Toolkit for Runtimes
Red Hat Integration - Service Registry
IBM MaaS360 Mobile Enterprise Gateway
Red Hat build of Quarkus
Red Hat Integration Camel Extensions for Quarkus
IBM Watson Discovery for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Tivoli Business Service Manager
UCD - IBM UrbanCode Deploy
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite - Manage Component
IBM Workload Scheduler
IBM Spectrum Protect Plus
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Operations Dashboard
watsonx.data
Kotlin Ktor
Oracle Utilities Testing Accelerator
Oracle Banking Corporate Lending Process Management
Oracle Banking Branch
Oracle Banking Liquidity Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Virtual Account Management
JBoss Enterprise Application Platform
Oracle Coherence
AMQ Streams
AMQ Broker
Communications Service Catalog and Design
Oracle Communications Instant Messaging Server
PeopleSoft Enterprise PeopleTools
Planning Analytics Local
Oracle Commerce Guided Search
IBM DB2
Oracle NoSQL Database
Oracle TimesTen In-Memory Database
Oracle Database Server
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Slice Selection Function
libnetty-java (Ubuntu package)
eap7-netty-xnio-transport (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-bouncycastle (Red Hat package)
netty-tcnative-javadoc
netty-tcnative
eap7-undertow (Red Hat package)
eap7-jandex (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
netty3
netty3-javadoc
netty
netty-help
netty (Debian package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
netty-javadoc
netty-poms
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
IBM Disconnected Log Collector
Red Hat OpenShift Serverless
IBM Cloud Pak System
IBM MaaS360 VPN Module
JBoss Data Grid
Event Streams

Install updates from vendor's website.

Netty - update to 4.1.108
DataPower Operations Dashboard - update to 1.0.21.0
IBM Process Mining - update to 1.15.0
IBM Cloud Transformation Advisor - update to 3.10.2
watsonx.data - update to 2.2.1
Kotlin Ktor - update to 2.3.12
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Knowledge Catalog Premium Cartridge - update to 5.2
Oracle Utilities Testing Accelerator - update to 6.0.0.3.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
JBoss Enterprise Application Platform - update to 7.4.18
Db2 Big SQL - update to 7.6.8
IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library - update to 40.0
Oracle Database Server - update to 23.6
libnetty-java (Ubuntu package) - addressed in versions Ubuntu Pro, 1:4.1.48-10ubuntu0.1
eap7-netty-xnio-transport (Red Hat package) - addressed in versions 0.1.10-1.Final_redhat_00001.1.el7eap, 0.1.10-1.Final_redhat_00001.1.el8eap, 0.1.10-1.Final_redhat_00001.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.8
Migration Toolkit for Runtimes - update to 1.2.7
eap7-log4j-jboss-logmanager (Red Hat package) - addressed in versions 1.3.1-1.Final_redhat_00002.1.el7eap, 1.3.1-1.Final_redhat_00002.1.el8eap, 1.3.1-1.Final_redhat_00002.1.el9eap
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.17-1.Final_redhat_00001.1.el7eap, 1.5.17-1.Final_redhat_00001.1.el8eap, 1.5.17-1.Final_redhat_00001.1.el9eap
IBM Disconnected Log Collector - update to 1.8.6
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-37.Final_redhat_00037.1.el7eap, 1.10.0-37.Final_redhat_00037.1.el8eap, 1.10.0-37.Final_redhat_00037.1.el9eap
Red Hat OpenShift Serverless - update to 1.33.0
eap7-bouncycastle (Red Hat package) - addressed in versions 1.78.1-1.redhat_00002.1.el7eap, 1.78.1-1.redhat_00002.1.el8eap, 1.78.1-1.redhat_00002.1.el9eap
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
netty-tcnative-javadoc - update to 2.0.65-150200.3.19.1
netty-tcnative - update to 2.0.65-150200.3.19.1
eap7-undertow (Red Hat package) - addressed in versions 2.2.33-1.SP1_redhat_00001.1.el7eap, 2.2.33-1.SP1_redhat_00001.1.el8eap, 2.2.33-1.SP1_redhat_00001.1.el9eap
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
eap7-jandex (Red Hat package) - addressed in versions 2.4.5-1.Final_redhat_00001.1.el7eap, 2.4.5-1.Final_redhat_00001.1.el8eap, 2.4.5-1.Final_redhat_00001.1.el9eap
AMQ Streams - addressed in versions 2.5.2, 2.7.0
Red Hat Integration - Service Registry - update to 2.5.11
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.800
IBM MaaS360 VPN Module - update to 3.000.800
Red Hat build of Quarkus - addressed in versions 3.2.12, 3.8.4
eap7-hal-console (Red Hat package) - addressed in versions 3.3.23-1.Final_redhat_00001.1.el7eap, 3.3.23-1.Final_redhat_00001.1.el8eap, 3.3.23-1.Final_redhat_00001.1.el9eap
Red Hat Integration Camel Extensions for Quarkus - update to 3.8.4.SP1
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.8.16-1.Final_redhat_00001.1.el7eap, 3.8.16-1.Final_redhat_00001.1.el8eap, 3.8.16-1.Final_redhat_00001.1.el9eap
netty3 - update to 3.10.6-9
netty3 - update to 3.10.6-150200.3.10.1
netty3-javadoc - update to 3.10.6-150200.3.10.1
netty - update to 4.1.13-22
netty-help - update to 4.1.13-22
netty (Debian package) - addressed in versions 1:4.1.48-7+deb12u2, 1:4.1.48-10+deb13u1
eap7-netty (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.108-1.Final_redhat_00001.1.el7eap, 4.1.108-1.Final_redhat_00001.1.el8eap, 4.1.108-1.Final_redhat_00001.1.el9eap
netty - update to 4.1.108-150200.4.23.1
netty-javadoc - update to 4.1.108-150200.4.23.1
netty-poms - update to 4.1.108-150200.4.23.1
IBM Cloud Pak for Watson AIOps - update to 4.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
watsonx Assistant for IBM Cloud Pak for Data - update to 4.8.8
DataStage on Cloud Pak for Data - update to 5.0.0
User Entity Behavior Analytics - update to 5.0.2
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.29-1.Final_redhat_00001.1.el7eap, 5.0.29-1.Final_redhat_00001.1.el8eap, 5.0.29-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
watsonx Assistant Cartridge - update to 5.1.3
Dell Secure Connect Gateway - update to 5.28.00.14
IBM Tivoli Business Service Manager - update to 6.2.0.5.5
UCD - IBM UrbanCode Deploy - addressed in versions 7.0.5.22, 7.1.2.18, 7.2.3.11, 7.3.2.6
eap7-wildfly (Red Hat package) - addressed in versions 7.4.18-1.GA_redhat_00001.1.el7eap, 7.4.18-1.GA_redhat_00001.1.el8eap, 7.4.18-1.GA_redhat_00001.1.el9eap
AMQ Broker - update to 7.12.0
DevOps Deploy - update to 8.0.1.1
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.24
JBoss Data Grid - update to 8.5.0
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.9, 8.7.4
Storage Virtualize - update to 8.7.0.0
Maximo Application Suite - Monitor Component - addressed in versions 8.10.10, 8.11.7
Telco Service Activator - update to 9.1.31
IBM Workload Scheduler - addressed in versions 9.5.0.7, 10.1.0.5, 10.2.2
IBM Spectrum Protect Plus - update to 10.1.6.4
IBM Event Endpoint Management - update to 11.2.1
Event Streams - update to 11.5.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 21.0.3.33, 23.0.2.5, 24.0.0-IF001
Business Automation Insights - update to 23.0.2.0.5
IBM Observability with Instana - update to 272
Operations Dashboard - update to 2022.2.1-23

• https://github.com/netty/netty/security/advisories/GHSA-5jpm-x58v-624v

• Information disclosure in Netty
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Information disclosure in IBM DevOps Deploy / IBM UrbanCode Deploy (UCD)
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender Mobile Enterprise Gateway (MEG) and VPN Module
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in Red Hat build of Quarkus 3.2
• Multiple vulnerabilities in Red Hat build of Quarkus 3.8
• Multiple vulnerabilities in AMQ Broker 7.12
• Multiple vulnerabilities in Red Hat Integration - Service Registry 2.5
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 3.8.4
• Multiple vulnerabilities in AMQ Streams 2.7
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.33
• Information disclosure in Kotlin Ktor
• Information disclosure in IBM Datapower Operations Dashboard
• Information disclosure in IBM Process Mining
• Information disclosure in IBM Db2
• SUSE update for netty3
• Information disclosure in IBM Storage Virtualize
• Information disclosure in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Oracle Communications Converged Charging System
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Information disclosure in Oracle TimesTen In-Memory Database
• Multiple vulnerabilities in Oracle Coherence
• Information disclosure in Oracle Banking Platform
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Branch
• Information disclosure in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in JBoss Data Grid 8.5
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Cloud APM
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• Information disclosure in IBM Maximo Application Suite - Manage Component
• Information disclosure in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Information disclosure in IBM Watson Discovery for IBM Cloud Pak for Data
• Information disclosure in IBM Tivoli Netcool/OMNIbus Integration – Transport Module Common Integration Library
• Information disclosure in Operations Dashboard
• Multiple vulnerabilities in Datacap
• Information disclosure in IBM Workload Scheduler
• Multiple vulnerabilities in IBM Tivoli Business Service Manager
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Information disclosure in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in AMQ Streams 2.5
• Information disclosure in Oracle NoSQL Database
• Multiple vulnerabilities in Oracle Database Server
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Information disclosure in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Enterprise Manager Base Platform
• Information disclosure in Oracle Utilities Network Management System
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• IBM B2B Sterling Integrator update for Netty
• openEuler update for netty
• openEuler update for netty3
• IBM SPSS Analytic Server update for Netty
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• IBM watsonx Assistant for IBM Cloud Pak for Data update for Netty
• Ubuntu update for netty
• IBM DataStage on Cloud Pak for Data update for Netty
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for Netty
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in HPE Telco Service Activator
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Netty
• IBM watsonx.data update for Netty
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Debian update for netty
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge