漏洞信息详情
Netty 拒绝服务漏洞
- CNNVD编号:CNNVD-201407-740
- 危害等级: 中危
- CVE编号: CVE-2014-3488
- 漏洞类型: 缓冲区错误
- 发布时间: 2014-07-31
- 威胁类型: 远程
- 更新时间: 2022-07-22
- 厂 商: netty_project
- 漏洞来源:
漏洞简介
Netty是Netty项目社区的一个提供了异步的、事件驱动的Java网络应用程序框架和工具,它用以快速开发高性能、高可靠性的网络服务器和客户端程序。
Netty 3.9.2之前版本的SslHandler中存在安全漏洞。远程攻击者可通过发送特制的‘SSLv2Hello’消息利用该漏洞造成拒绝服务(无限循环和CPU资源耗尽)。
漏洞公告
目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:
http://netty.io/news/2014/06/11/3-9-2-Final.HTML
参考网址
来源:CONFIRM
链接:https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994
来源:SECUNIA
链接:http://secunia.com/advisories/59196
来源:CONFIRM
链接:http://netty.io/news/2014/06/11/3-9-2-Final.HTML
来源:CONFIRM
链接:https://github.com/netty/netty/issues/2562
来源:MLIST
链接:https://lists.debian.org/debian-lts-announce/2020/02/msg00018.HTML
来源:lists.debian.org
链接:https://lists.debian.org/debian-lts-announce/2020/02/msg00018.HTML
来源:vigilance.fr
链接:https://vigilance.fr/vulnerability/Netty-overload-via-SSLv2Hello-SslHandler-31648
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-3/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-2/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-db2-that-affect-the-ibm-performance-management-product/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2020.0583/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2020.1427/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-warehouse-has-released-a-fix-in-response-to-multiple-vulnerabilities-found-in-ibm-db2/
来源:www.cybersecurity-help.cz
链接:https://www.cybersecurity-help.cz/vdb/SB2022072128
受影响实体
- Netty_project Netty:3.6.0
- Netty_project Netty:3.6.1
- Netty_project Netty:3.6.2
- Netty_project Netty:3.6.3
- Netty_project Netty:3.6.4
补丁
- netty-3.9.2.Final-dist
![weinxin](http://zone.ci/zone_ci_images/zone.ci.png)
评论