Lucene search

ROSA LABROSA-SA-2023-2304

HistoryDec 12, 2023 - 12:18 p.m.

Advisory ROSA-SA-2023-2304

2023-12-1212:18:26

ROSA LAB

abf.rosalinux.ru

netty 4.1.13

rosa-chrome

snihandler component

denial of service

remote exploitation

resolved

resource consumption

update required

unix

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

software: netty 4.1.13
WASP: ROSA-CHROME

package_evr_string: netty-4.1.13-13.src.rpm

CVE-ID: CVE-2023-34462
BDU-ID: 2023-05355
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the SniHandler component of the Netty networking software tool is associated with uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service
CVE-STATUS: Resolved
CVE-REV: To close, run the command: sudo dnf update netty

OSVersionArchitecturePackageVersionFilename
ROSAanynoarchnetty< 4.1.13UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ROSA	any	noarch	netty	< 4.1.13	UNKNOWN

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

47.2%

JSON

Related for ROSA-SA-2023-2304