CVE-2016-4970 Loop with Unreachable Exit Condition in Netty
HighCVSS 7.5
EPSS 11.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| io.netty/netty-handler(Maven) | >= 4.0.0.Alpha1, < 4.0.37.Final | 4.0.37.Final |
| io.netty/netty-handler(Maven) | >= 4.1.0.Beta1, < 4.1.1.Final | 4.1.1.Final |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha1 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha2 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha3 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha4 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha5 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha6 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha7 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Alpha8 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Beta1 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Beta2 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Beta3 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR1 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR2 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR3 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR4 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR5 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR6 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR7 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR8 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.CR9 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.0.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.1.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.10.Final | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| io.netty/netty-handler(Maven) | = 4.0.11.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.12.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.13.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.14.Beta1 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.14.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.15.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.16.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.17.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.18.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.19.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.2.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.20.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.21.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.22.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.23.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.24.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.25.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.26.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.27.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.28.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.29.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.3.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.30.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.31.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.32.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.33.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.34.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.35.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.36.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.4.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.5.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.6.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.7.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.8.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.0.9.Final | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta1 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta2 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta3 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta4 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta5 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta6 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta7 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Beta8 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR1 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR2 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR3 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR4 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR5 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR6 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.CR7 | No fix listed |
| io.netty/netty-handler(Maven) | = 4.1.0.Final | No fix listed |
| debian/netty(Debian:12) | < 1:4.0.37-1 | 1:4.0.37-1 |
| debian/netty(Debian:13) | < 1:4.0.37-1 | 1:4.0.37-1 |
| debian/netty(Debian:14) | < 1:4.0.37-1 | 1:4.0.37-1 |
| netty | >= 4.0.20, < 4.0.37 | 4.0.37 |
| netty | >= 4.1.0, < 4.1.1 | 4.1.1 |
| redhat jboss data grid | = 7.1 | No fix listed |
| redhat jboss middleware text-only advisories | = 1.0 | No fix listed |
| apache cassandra | = 3.11.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- lists.apache.org
- wiki.opendaylight.org third-party-advisory
- netty.io release-notes vendor-advisory
- netty.io release-notes vendor-advisory
- RHSA-2017:0179 third-party-advisory vendor-advisory
- RHSA-2017:1097 third-party-advisory vendor-advisory
- github.com
- github.com product
- Debian Security Tracker CVE-2016-4970 vendor-advisory
- 96540 third-party-advisory vdb-entry
- [cassandra-commits] 20191112 [jira] [Created] (CASSANDRA-15412) Security vulnerability CVE-2016-4970 for Netty mailing-list
- bugs.debian.org issue-tracking