Overview
About vulnerability
Summary
An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attemps to load a file that does not exist. If an attacker creates such a large file, the Netty application crash.
Details
A similar issue was previously reported in https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit.
PoC
The PoC is the same as for https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv with the detail that the file should only contain null-bytes; 0x00.
When the null-bytes are encountered by the InputStreamReader, it will issue replacement characters in its charset decoding, which will fill up the line-buffer in the BufferedReader.readLine(), because the replacement character is not a line-break character.
Impact
Impact is the same as https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
Details
- Affected product:
- Apache ActiveMQ , Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Lucene , Apache Solr , Apache Spark , Eclipse Jetty , Netty , Spring , Wildfly , accumulo , agepredictor , artemis , async-http-client , avro , aws-sdk-java , azure-sdk-for-java , bookkeeper-common-allocator , californium , camel , cassandra-java-driver , catalyst , corda , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , docker-java , drill , druid , elasticsearch , etcd4j , flink , flink-shaded , flume-ng-sdk , gora , grpc-java , grpc-netty , hbase , http-client , infinispan , java-driver , lettuce , lettuce-core , littleproxy , logging-flume , micronaut-core , milo , neo4j-java-driver , neo4j-ogm , netty , olingo-odata4 , pgjdbc-ng , pulsar , pulsar-client-all , rabbitmq-stream-java-client , ribbon , rsocket-java , rxnetty , sonatype-aether , stack-core , tika , vert.x , wildfly , zendesk-java-client , zookeeper
- Affected packages:
- fcgi-server @ 10.0.28 (+14509 more)