CVE-2023-4586
Withdrawn Advisory: Netty-handler does not validate host names by default
Impact
## Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references. ## Original Description Netty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the `5.x` release branch with no backport planned. In the interim users are advised to enable host name validation in their configurations. See https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.netty:netty-handler | >= 4.1.0.Final, <= 4.1.99.Final | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Data Grid | Version 8.0.0 |
| Infinispan | Hot Rod | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2023:7676
- https://access.redhat.com/security/cve/CVE-2023-4586
- https://bugzilla.redhat.com/show_bug.cgi?id=2235564
- https://github.com/advisories/GHSA-57m8-f3v5-hm5m
- https://nvd.nist.gov/vuln/detail/CVE-2023-4586
- https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-1042268
- https://github.com/netty/netty/issues/8537
- https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLParameters.html#setEndpointIdentificationAlgorithm-java.lang.String-