Bug 1107983 (CVE-2014-3488)

Summary:	CVE-2014-3488 Netty: DoS by CPU exhaustion when using malicious SSL packets
Product:	[Other] Security Response	Reporter:	Arun Babu Neelicattu <aneelica>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	grocha, jrusnack, nmaurer, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Netty 3.9.2.Final	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 08:53:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Arun Babu Neelicattu 2014-06-11 08:41:35 UTC

It was discovered that when handling specifically crafted SSL packets, the SslHandler implementation in Netty entered an infinite loop. An unauthenticated remote attacker could use this flaw to trigger a denial of service by CPU exhaustion.

Affects: 3.9.0, 3.9.1

Comment 1 Arun Babu Neelicattu 2014-06-11 08:46:29 UTC

Statement:

Netty versions as shipped by Red Hat products are not affected by this flaw.

Comment 4 Norman Maurer 2014-06-11 09:41:11 UTC

Here is the issue and the fix:
https://github.com/netty/netty/issues/2562

Comment 5 Norman Maurer 2014-06-11 10:14:50 UTC

Netty 3.9.2.Final was released with the fix included.

See http://netty.io/news/2014/06/11/3.html

Comment 6 Arun Babu Neelicattu 2014-06-13 08:40:40 UTC

Acknowledgement:

Red Hat would like to thank Laurentiu Luca for reporting this issue.