GHSA-57m8-f3v5-hm5m
Dashboard / Vulnerabilities / GHSA-57m8-f3v5-hm5m
Summary: Withdrawn Advisory: Netty-handler does not validate host names by default
Details: ## Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references. ## Original Description Netty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the `5.x` release branch with no backport planned. In the interim users are advised to enable host name validation in their configurations. See https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.
References: https://nvd.nist.gov/vuln/detail/CVE-2023-4586, https://github.com/netty/netty/issues/8537, https://access.redhat.com/security/cve/CVE-2023-4586, https://bugzilla.redhat.com/show_bug.cgi?id=2235564, https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLParameters.html#setEndpointIdentificationAlgorithm-java.lang.String-, https://github.com/netty/netty, https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-1042268
Affected packages
Package
Name: io.netty:netty-handler
Purl: pkg:maven/io.netty/netty-handler
Affected ranges
Type: ECOSYSTEM
Events:
