The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5558 advisory.

  - Netty is an asynchronous event-driven network application framework for rapid development of maintainable     high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each     channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be     used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a     handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server     name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the     `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but     there are not checks done here and the way the code is written, it is possible to craft a packet that     makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
    (CVE-2023-34462)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5558-1 : netty - security update

high Nessus Plugin ID 185979

Version 1.1

Version 1.0

Version 1.1 Feb 9, 2024, 11:26 PM CEA reference Plugin Feed: 202402092326
Version 1.0 Nov 18, 2023, 11:56 PM New Plugin Feed: 202311182356