Описание
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.
Отчет
This is an Important denial of service vulnerability in netty-codec-redis, affecting Red Hat products that process Redis payloads. A remote attacker can exhaust server memory by sending a crafted Redis payload with deeply nested arrays, leading to an OutOfMemoryError and rendering the service unresponsive. This impact is significant due to the potential for complete service disruption without authentication.
Меры по смягчению последствий
To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | netty-codec-redis | Affected | ||
| Red Hat Data Grid 8 | netty-codec-redis | Affected | ||
| Red Hat Fuse 7 | netty-codec-redis | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 7 | netty-codec-redis | Affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | netty-codec-redis | Affected | ||
| Red Hat Single Sign-On 7 | netty-codec-redis | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Netty is a network application framework for development of protocol s ...
Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays
EPSS
7.5 High
CVSS3