Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6994-1 advisory.

    It was discovered that Netty did not properly sanitize its input parameters. A remote attacker could     possibly use this issue to cause a crash. (CVE-2023-34462)

    It was discovered that Netty incorrectly handled request cancellation. A remote attacker could possibly     use this issue to cause Netty to consume resources, leading to a denial of service. (CVE-2023-44487)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - netty: SniHandler 16MB allocation leads to OOM (CVE-2023-34462)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - netty: SniHandler 16MB allocation leads to OOM (CVE-2023-34462)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of Oracle TimesTen installed on the remote host is 18.x prior to 18.1.4.39.0 or 22.x prior to 22.1.1.18.0.
It is, therefore, affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory:

  - Security-in-Depth issue in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database     (component: EM TimesTen plug-in (Golang Go)). This vulnerability cannot be exploited in the context of this     product. (CVE-2023-29402, CVE-2023-29403, CVE-2023-29404 and CVE-2023-29405)

  - Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: EM     TimesTen plug-in (Netty)). Supported versions that are affected are Prior to 22.1.1.18.0 and Prior to     18.1.4.39.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to     compromise TimesTen In-Memory Database. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of TimesTen In-Memory Database.
    (CVE-2023-34462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5558 advisory.

  - Netty is an asynchronous event-driven network application framework for rapid development of maintainable     high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each     channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be     used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a     handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server     name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the     `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but     there are not checks done here and the way the code is written, it is possible to craft a packet that     makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
    (CVE-2023-34462)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Analytics Server (Apache Spark)). The supported version that is affected is 6.4.0.0.0. Easily   exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle   Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence   Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks   of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition.
  (CVE-2023-22946)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Analytics Server (Apache Hadoop)). The supported version that is affected is 6.4.0.0.0. Easily   exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle   Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of   Oracle Business Intelligence Enterprise Edition. (CVE-2022-26612)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Content Storage Service (Apache Commons Configuration)). Supported versions that are affected   are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this   vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by a denial of service vulnerability as referenced in the Ocotber 2023 CPU advisory:

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Third Party (Netty)).     Supported versions that are affected are 14.1.1.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of Oracle Coherence. (CVE-2023-34462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Discussion Forums     (OSCORE)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks     of this vulnerability can result in takeover of Oracle WebCenter Portal. (CVE-2023-39022)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Development Tools     (Apache Commons BCEL)). The supported version that is affected is 12.2.1.4.0.. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Documaker. Successful attacks     of this vulnerability can result in takeover of Oracle Documaker. (CVE-2022-42920)

  - Security-in-Depth issue in the Oracle Database Workload Manager (jackson-databind) component of Oracle Database     Server. This vulnerability cannot be exploited in the context of this product (CVE-2022-42004)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5486 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5485 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5484 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2974-1 advisory.

  - Netty is an asynchronous event-driven network application framework for rapid development of maintainable     high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each     channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be     used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a     handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server     name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the     `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but     there are not checks done here and the way the code is written, it is possible to craft a packet that     makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
    (CVE-2023-34462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206685	Ubuntu 22.04 LTS : Netty vulnerabilities (USN-6994-1)	Nessus	Ubuntu Local Security Checks	high
198553	RHEL 9 : netty (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198503	RHEL 8 : netty (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
187317	Oracle TimesTen 18.x < 18.1.4.39.0, 22.x < 22.1.1.18.0 Multiple Vulnerabilities (October 2023 CPU)	Nessus	Misc.	critical
185979	Debian DSA-5558-1 : netty - security update	Nessus	Debian Local Security Checks	high
183507	Oracle Business Intelligence Enterprise Edition (OAS 6.4) (October 2023 CPU)	Nessus	Misc.	critical
183310	Oracle Coherence DoS (October 2023 CPU)	Nessus	Misc.	medium
183294	Oracle WebCenter Portal Multiple Vulnerabilities (October 2023 CPU)	Nessus	Misc.	critical
182684	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9 (Important) (RHSA-2023:5486)	Nessus	Red Hat Local Security Checks	critical
182683	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8 (Important) (RHSA-2023:5485)	Nessus	Red Hat Local Security Checks	critical
182622	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7 (Important) (RHSA-2023:5484)	Nessus	Red Hat Local Security Checks	critical
178933	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : netty, netty-tcnative (SUSE-SU-2023:2974-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-34462

medium

Tenable Plugins

high

medium

medium

critical

high

critical

medium

critical

critical

critical

critical

medium