[Bug 1816216] New: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
10:18 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Bug ID: 1816216
Summary: netty: compression/decompression codecs don't enforce
limits on buffer allocation sizes
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jerboaa(a)gmail.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jross(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, rchan(a)redhat.com,
rgodfrey(a)redhat.com, rguimara(a)redhat.com,
rjerrido(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, sochotni(a)redhat.com,
sokeeffe(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com, sthorger(a)redhat.com,
swoodman(a)redhat.com, tbrisker(a)redhat.com,
theute(a)redhat.com, tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Netty in the way it handles the amount of data
they compress and decompress. Compression/Decompression Codecs should enforce
memory allocation size limits to avoid OOME or exhaust the memory pool.
Reference:
https://github.com/netty/netty/pull/9924
--
You are receiving this mail because:
You are on the CC list for the bug.
10:21 a.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |1816217
--
You are receiving this mail because:
You are on the CC list for the bug.
7:53 p.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|high |medium
Severity|high |medium
--
You are receiving this mail because:
You are on the CC list for the bug.
9:02 p.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #2 from Jason Shepherd <jshepherd(a)redhat.com> ---
Statement:
In OpenShift Container Platform end users don't have direct access to send
requests to ElasticSearch. A user could need access to the ElasticSearch
service on the internal cluster network in order to be able to send malicious
requests to it.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:29 p.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1816447
--
You are receiving this mail because:
You are on the CC list for the bug.
10:29 p.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1816448
--
You are receiving this mail because:
You are on the CC list for the bug.
10:28 a.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Cedric Buissart 🐶 <cbuissar(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1818879
--
You are receiving this mail because:
You are on the CC list for the bug.
6:40 a.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version| |netty-4.1.46.Final
--
You are receiving this mail because:
You are on the CC list for the bug.
10:31 a.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Doc Text *updated* by RaTasha Tillery-Smith <rtillery(a)redhat.com> ---
A flaw was found in Netty in the way it handles the amount of data it compresses and
decompresses. The Compression/Decompression codecs should enforce memory allocation size
limits to avoid an Out of Memory Error (OOME) or exhaustion of the memory pool.
--
You are receiving this mail because:
You are on the CC list for the bug.
10:15 a.m.
New subject: [Bug 1816216] netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #9 from Jonathan Christison <jochrist(a)redhat.com> ---
The AMQ Broker has been marked as having a low impact, this is because although
netty is built and distributed with the AMQ broker its actual use in the
product doesn't use the decompression functionality provided by netty (jzlib)
--
You are receiving this mail because:
You are on the CC list for the bug.
5:04 a.m.
New subject: [Bug 1816216] CVE-2020-10707 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Dhananjay Arunesh <darunesh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|netty: |CVE-2020-10707 netty:
|compression/decompression |compression/decompression
|codecs don't enforce limits |codecs don't enforce limits
|on buffer allocation sizes |on buffer allocation sizes
Alias| |CVE-2020-10707
--
You are receiving this mail because:
You are on the CC list for the bug.
4:51 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|CVE-2020-10707 netty: |CVE-2020-11612 netty:
|compression/decompression |compression/decompression
|codecs don't enforce limits |codecs don't enforce limits
|on buffer allocation sizes |on buffer allocation sizes
Alias|CVE-2020-10707 |CVE-2020-11612
--
You are receiving this mail because:
You are on the CC list for the bug.
4:12 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #15 from Jonathan Christison <jochrist(a)redhat.com> ---
AMQ Online has been marked as having a low impact, this is because although
netty distributed with AMQ Online its actual use in the product doesn't use the
decompression functionality provided by netty (jzlib)
--
You are receiving this mail because:
You are on the CC list for the bug.
7:08 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #16 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat AMQ Online 1.4.1 GA
Via RHSA-2020:1538 https://access.redhat.com/errata/RHSA-2020:1538
--
You are receiving this mail because:
You are on the CC list for the bug.
7:08 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:1538
--
You are receiving this mail because:
You are on the CC list for the bug.
11:32 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Product Security DevOps Team <prodsec-dev(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |ERRATA
Last Closed| |2020-04-22 16:32:29
--- Comment #17 from Product Security DevOps Team <prodsec-dev(a)redhat.com> ---
This bug is now closed. Further updates for individual products will be
reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-11612
--
You are receiving this mail because:
You are on the CC list for the bug.
8:52 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes
Via RHSA-2020:1422 https://access.redhat.com/errata/RHSA-2020:1422
--
You are receiving this mail because:
You are on the CC list for the bug.
8:52 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:1422
--
You are receiving this mail because:
You are on the CC list for the bug.
12:07 p.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #19 from Jonathan Christison <jochrist(a)redhat.com> ---
AMQ Clients has been marked as having a low impact, this is because although
netty is built and distributed its actual use in the product doesn't use the
decompression functionality provided by netty (jzlib).
--
You are receiving this mail because:
You are on the CC list for the bug.
2:47 p.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #21 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
AMQ Clients 2.y for RHEL 6
AMQ Clients 2.y for RHEL 7
AMQ Clients 2.y for RHEL 8
Via RHSA-2020:2605 https://access.redhat.com/errata/RHSA-2020:2605
--
You are receiving this mail because:
You are on the CC list for the bug.
2:47 p.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:2605
--
You are receiving this mail because:
You are on the CC list for the bug.
8:39 p.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #22 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat AMQ Streams 1.5.0
Via RHSA-2020:2618 https://access.redhat.com/errata/RHSA-2020:2618
--
You are receiving this mail because:
You are on the CC list for the bug.
8:39 p.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:2618
--
You are receiving this mail because:
You are on the CC list for the bug.
9:14 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #23 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat AMQ
Via RHSA-2020:2751 https://access.redhat.com/errata/RHSA-2020:2751
--
You are receiving this mail because:
You are on the CC list for the bug.
9:14 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:2751
--
You are receiving this mail because:
You are on the CC list for the bug.
10:10 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #24 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat AMQ
Via RHSA-2020:3133 https://access.redhat.com/errata/RHSA-2020:3133
--
You are receiving this mail because:
You are on the CC list for the bug.
10:10 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3133
--
You are receiving this mail because:
You are on the CC list for the bug.
1:08 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #25 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Decision Manager
Via RHSA-2020:3196 https://access.redhat.com/errata/RHSA-2020:3196
--
You are receiving this mail because:
You are on the CC list for the bug.
1:08 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3196
--
You are receiving this mail because:
You are on the CC list for the bug.
1:23 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #26 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Process Automation
Via RHSA-2020:3197 https://access.redhat.com/errata/RHSA-2020:3197
--
You are receiving this mail because:
You are on the CC list for the bug.
1:23 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3197
--
You are receiving this mail because:
You are on the CC list for the bug.
1:37 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #27 from Yadnyawalk Tale <ytale(a)redhat.com> ---
Statement:
In OpenShift Container Platform end users don't have direct access to send
requests to ElasticSearch. A user could need access to the ElasticSearch
service on the internal cluster network in order to be able to send malicious
requests to it.
Red Hat Satellite 6.7 and earlier ship affected version of netty and its
dependency, however, there is no external connection being exposed and it is
used by only Artemis to open an internal connection within the JVM. Since netty
does not come into contact with untrusted data, vulnerability is not exposed in
product code. We may update the netty and its dependency in a future release.
--
You are receiving this mail because:
You are on the CC list for the bug.
1:41 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Yadnyawalk Tale <ytale(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|27 |updated
--- Comment #27 has been edited ---
Statement:
In OpenShift Container Platform end users don't have direct access to send
requests to ElasticSearch. A user could need access to the ElasticSearch
service on the internal cluster network in order to be able to send malicious
requests to it.
Red Hat Satellite 6.7 and earlier ship affected version of netty and its
dependency, however, there is no external connection being exposed and it is
used by only Artemis to open an internal connection within the JVM. Since netty
does not come into contact with untrusted data, vulnerability is not exposed in
product code. We may update the netty and its dependency in a future release.
--
You are receiving this mail because:
You are on the CC list for the bug.
1:49 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Yadnyawalk Tale <ytale(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|27 |updated
--- Comment #27 has been edited ---
Statement:
In OpenShift Container Platform end users don't have direct access to send
requests to ElasticSearch. A user could need access to the ElasticSearch
service on the internal cluster network in order to be able to send malicious
requests to it.
Third party scanners flagging Red Hat Satellite due to availability of the
higher version packages in Red Hat AMQ Clients (through errata RHSA-2020:2605)
and the qpid-proton from Satellite Tools repository. qpid-proton dependency
fixed in errata RHSA-2020:2605 was for Red Hat AMQ Clients and it doesn't
necessarily mean that pid-proton from Satellite Tools is affected. These are
two different products with different architecture and code-base. Updating the
packages from any other repository than the Satellite-tools repository is not
recommended for Satellite Customers.
Red Hat Satellite 6.7 and earlier ship affected version of netty, however,
there is no external connection being exposed and it is used by only Artemis to
open an internal connection within the JVM. Since netty does not come into
contact with untrusted data, vulnerability is not exposed in product code and
there is no breach of Confidentiality, Integrity or Availability expected from
this vulnerability. We may update the netty and its dependency in a future
release.
More information regarding Satellite related packages can be found on KCS:
https://access.redhat.com/solutions/5200591
--
You are receiving this mail because:
You are on the CC list for the bug.
8:23 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1865894
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1865894
[Bug 1865894] CVE-2020-11612 netty: compression/decompression codecs don't
enforce limits on buffer allocation sizes [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
8:23 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #28 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com> ---
Created netty tracking bugs for this issue:
Affects: fedora-all [bug 1865894]
--
You are receiving this mail because:
You are on the CC list for the bug.
7:04 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Yadnyawalk Tale <ytale(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On| |1866342
--
You are receiving this mail because:
You are on the CC list for the bug.
11:35 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #29 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Single Sign-On 7.4.2
Via RHSA-2020:3501 https://access.redhat.com/errata/RHSA-2020:3501
--
You are receiving this mail because:
You are on the CC list for the bug.
11:35 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3501
--
You are receiving this mail because:
You are on the CC list for the bug.
8:35 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Yadnyawalk Tale <ytale(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends On|1866342 |
--
You are receiving this mail because:
You are on the CC list for the bug.
10:41 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #30 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
EAP-CD 20 Tech Preview
Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585
--
You are receiving this mail because:
You are on the CC list for the bug.
10:41 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3585
--
You are receiving this mail because:
You are on the CC list for the bug.
11:50 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #31 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Data Grid
Via RHSA-2020:3626 https://access.redhat.com/errata/RHSA-2020:3626
--
You are receiving this mail because:
You are on the CC list for the bug.
11:50 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3626
--
You are receiving this mail because:
You are on the CC list for the bug.
8:08 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #32 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Data Grid 7.3.7
Via RHSA-2020:3779 https://access.redhat.com/errata/RHSA-2020:3779
--
You are receiving this mail because:
You are on the CC list for the bug.
8:08 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:3779
--
You are receiving this mail because:
You are on the CC list for the bug.
11:50 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Bug 1816216 depends on bug 1865894, which changed state.
Bug 1865894 Summary: CVE-2020-11612 netty: compression/decompression codecs don't
enforce limits on buffer allocation sizes [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1865894
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
--
You are receiving this mail because:
You are on the CC list for the bug.
6:17 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #33 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat build of Quarkus 1.7.5
Via RHSA-2020:4252 https://access.redhat.com/errata/RHSA-2020:4252
--
You are receiving this mail because:
You are on the CC list for the bug.
6:17 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:4252
--
You are receiving this mail because:
You are on the CC list for the bug.
6:13 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #34 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Fuse 7.8.0
Via RHSA-2020:5568 https://access.redhat.com/errata/RHSA-2020:5568
--
You are receiving this mail because:
You are on the CC list for the bug.
6:13 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Link ID| |Red Hat Product Errata
| |RHSA-2020:5568
--
You are receiving this mail because:
You are on the CC list for the bug.
8:10 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #36 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> ---
This issue has been addressed in the following products:
Red Hat Satellite 6.8 for RHEL 7
Via RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313
--
You are receiving this mail because:
You are on the CC list for the bug.
8:10 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
--- Comment #37 from Jonathan Christison <jochrist(a)redhat.com> ---
Marking Red Hat Fuse 7 as having a low impact, Fuse 7 distributes affected
versions of Netty in the Karaf Narayana transaction manager, however the
vulnerable functionality of these artifacts is not used.
--
You are receiving this mail because:
You are on the CC list for the bug.
11 a.m.
New subject: [Bug 1816216] CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
https://bugzilla.redhat.com/show_bug.cgi?id=1816216
Lami Akagwu <lakagwu(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |lakagwu(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
1031
days inactive
1488
days old
java-sig-commits@lists.fedoraproject.org
53 comments
1 participants
participants (1)
-
bugzilla＠redhat.com