The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6049-1 advisory.

    It was discovered that Netty's Zlib decoders did not limit memory allocations. A remote attacker could     possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a denial of     service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-11612)

    It was discovered that Netty created temporary files with excessive permissions. A local attacker could     possibly use this issue to expose sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu     18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)

    It was discovered that Netty did not properly validate content-length headers. A remote attacker could     possibly use this issue to smuggle requests. This issue was only fixed in Ubuntu 20.04 ESM.
    (CVE-2021-21295, CVE-2021-21409)

    It was discovered that Netty's Bzip2 decompression decoder did not limit the decompressed output data     size. A remote attacker could possibly use this issue to cause Netty to exhaust memory via malicious     input, leading to a denial of service. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu     22.04 LTS, and Ubuntu 22.10. (CVE-2021-37136)

    It was discovered that Netty's Snappy frame decoder function did not limit chunk lengths. A remote     attacker could possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a     denial of service. (CVE-2021-37137)

    It was discovered that Netty did not properly handle control chars at the beginning and end of header     names. A remote attacker could possibly use this issue to smuggle requests. This issue only affected     Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-43797)

    It was discovered that Netty could be made into an infinite recursion when parsing a malformed crafted     message. A remote attacker could possibly use this issue to cause Netty to crash, leading to a denial of     service. This issue only affected Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41881)

    It was discovered that Netty did not validate header values under certain circumstances. A remote attacker     could possibly use this issue to perform HTTP response splitting via malicious header values. This issue     only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41915)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in Oracle NoSQL Database (component: Administration (Node.js)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle NoSQL Database.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. (CVE-2021-22883)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (jackson-databind)).
    This vulnerability cannot be exploited in the context of this product. (CVE-2019-14379)

  - Vulnerability in Oracle NoSQL Database (component: Administration (Google Guava)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise     Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle NoSQL Database accessible data. (CVE-2020-8908)   
  - Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version     that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle NoSQL Database. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle NoSQL Database. (CVE-2020-11612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the January 2021 Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities:

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework   (Apache Commons Compress)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle WebCenter Portal (CVE-2019-12402).

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework   (Netty)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows   unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of   this vulnerability can result in takeover of Oracle WebCenter Portal (CVE-2020-11612). 

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework   (Apache Tika)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability    allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Portal executes to    compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the    attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle WebCenter Portal (CVE-2020-9489).

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1313 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * foreman: Managing repositories with their id via hammer does not respect the role filters     (CVE-2017-2662)
    * python-psutil: Double free because of refcount mishandling (CVE-2019-18874)
    * candlepin: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes     (CVE-2020-11612)
    * foreman: world-readable OMAPI secret through the ISC DHCP server (CVE-2020-14335)
    * candlepin: resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)
    * python-django: potential SQL injection via tolerance parameter in GIS functions and aggregates on     Oracle (CVE-2020-9402)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    * Usability enhancements to Red Hat's Simple Content Access mode and Satellite

    * Usability improvements to enabling Remote Execution on your hosts.

    * Notifications in the UI to warn users when subscriptions are expiring.

    * Usability enhancements to enable Insights integration with Satellite.

    * Performance improvements to various aspects of the user interface and API.

    * Added support for OpenID Connect for authentication.

    * Usability improvements to the Satellite Installer.

    * Updated Ruby web server to the modern Puma application server which replaces Passenger.

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document linked to in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in Netty, a Java NIO client/server framework, which could result in HTTP request smuggling, denial of service or information disclosure.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4600-2 advisory.

    USN-4600-1 fixed multiple vunerabilities in Netty 3.9. This update provides the corresponding fixes for     CVE-2019-20444, CVE-2019-20445 for Netty.

    Also it was discovered that Netty allow for unbounded memory allocation. A remote attacker could send a     large stream to the Netty server causing it to crash (denial of service). (CVE-2020-11612)



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in netty, a Java NIO client/server socket framework.

CVE-2019-20444

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an 'invalid fold.'

CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVE-2020-7238

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

For Debian 9 stretch, these problems have been fixed in version 1:4.1.7-2+deb9u2.

We recommend that you upgrade your netty packages.

For the detailed security status of netty please refer to its security tracker page at: https://security-tracker.debian.org/tracker/netty

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3463 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.1 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.3.2 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3461 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.1, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.2 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3462 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.1, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.2 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2605 advisory.

    Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport     protocol to or from AMQ Broker 6 and 7.

    This update provides various bug fixes and enhancements in addition to the client package versions     previously released on Red Hat Enterprise Linux 6, 7, and 8.

    Security Fix(es):

    * netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
174932	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS : Netty vulnerabilities (USN-6049-1)	Nessus	Ubuntu Local Security Checks	medium
148977	Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	critical
148925	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Misc.	high
148903	RHEL 7 : Satellite 6.9 Release (Moderate) (RHSA-2021:1313)	Nessus	Red Hat Local Security Checks	critical
148326	Debian DSA-4885-1 : netty - security update	Nessus	Debian Local Security Checks	critical
141934	Ubuntu 18.04 LTS : Netty vulnerabilities (USN-4600-2)	Nessus	Ubuntu Local Security Checks	critical
140295	Debian DLA-2364-1 : netty security update	Nessus	Debian Local Security Checks	critical
139619	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3463)	Nessus	Red Hat Local Security Checks	critical
139618	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3461)	Nessus	Red Hat Local Security Checks	critical
139616	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3462)	Nessus	Red Hat Local Security Checks	critical
137563	RHEL 6 / 7 / 8 : AMQ Clients 2.7.0 Release (Low) (RHSA-2020:2605)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-11612

high

Tenable Plugins

medium

critical

high

critical

critical

critical

critical

critical

critical

critical

high