Bugzilla – Bug 1168932
VUL-1: CVE-2020-11612: netty: ZlibDecoders allow for unbounded memory allocation while decoding a ZlibEncoded byte stream
Last modified: 2022-10-27 13:24:21 UTC
CVE-2020-11612 The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11612 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11612 https://github.com/netty/netty/pull/9924 https://github.com/netty/netty/issues/6168 https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final
This is an autogenerated message for OBS integration: This bug (1168932) was mentioned in https://build.opensuse.org/request/show/792650 Factory / netty
This is an autogenerated message for OBS integration: This bug (1168932) was mentioned in https://build.opensuse.org/request/show/792763 Factory / netty
fixed
SUSE-SU-2022:3617-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src): netty-4.1.44.Final-150300.4.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3760-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (src): netty-4.1.44.Final-150400.3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3793-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1168932,1182103,1190610,1190613 CVE References: CVE-2020-11612,CVE-2021-21290,CVE-2021-37136,CVE-2021-37137 JIRA References: Sources used: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src): netty-4.1.44.Final-150200.3.4.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.