vulnwire
7.5high

CVE-2016-4970in critical feed

Loop with Unreachable Exit Condition in Netty

Also known as GHSA-rv63-gqm8-9w8q

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
11.3%
percentile 96%
Public exploits
0
none known

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

Exploit prediction (EPSS)

11.26% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD2.07.8AV:N/AC:L/Au:N/C:N/I:N/A:C
GitHub3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

EcosystemPackageAffectedFixed in
mavenio.netty:netty-handler
>=4.0.0.Alpha1, <4.0.37.Final
>=4.1.0.Beta1, <4.1.1.Final
4.0.37.Final
4.1.1.Final

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

  • rhn.redhat.com /errata/RHSA-2017-0179.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • rhn.redhat.com /errata/RHSA-2017-1097.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • netty.io /news/2016/06/07/4-1-1-Final.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/96540 · vdb-entry, x_refsource_BID, x_transferred
  • github.com /netty/netty/pull/5364 · x_refsource_CONFIRM, x_transferred
  • wiki.opendaylight.org /view/Security_Advisories · x_refsource_CONFIRM, x_transferred
  • netty.io /news/2016/06/07/4-0-37-Final.html · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1343616 · x_refsource_CONFIRM, x_transferred
  • lists.apache.org /thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassand · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-4970 · advisory
  • github.com /netty/netty · package
  • lists.apache.org /thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144@%3Ccommits.cassandra · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.