NetSight
IP …
high7.5

CVE-2020-11612

Denial of Service in Netty

Impact

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

Affected packages

EcosystemPackageAffectedFixed in
mavenio.netty:netty-handler>= 4.1.0, < 4.1.464.1.46

Affected products

VendorProductAffected versions
NettyNetty
from 4.1 before 4.1.46
DebianDebian Linux
Versions 9.0, 10.0
FedoraprojectFedora
Version 33
NetappOncommand Api Services
All versions
NetappOncommand Insight
All versions
NetappOncommand Workflow Automation
All versions
OracleCommunications Brm - Elastic Charging Engine
Version 12.0.0.3
OracleCommunications Cloud Native Core Service Communication Proxy
Version 1.5.2
OracleCommunications Design Studio
Version 7.4.2
OracleNosql Database
before 20.3
OracleSiebel Core - Server Framework
before 21.5
OracleWebcenter Portal
Versions 12.2.1.3.0, 12.2.1.4.0

Weakness classification

CWE-770CWE-119CWE-400

References