CVE-2024-47535

[github-actions]

netty: Denial of Service attack on windows app using Netty

https://avd.aquasec.com/nvd/cve-2024-47535

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

Projects:

• accredited-programmes-and-oasys
• appointment-reminders-and-delius
• approved-premises-and-delius
• approved-premises-and-oasys
• arns-and-delius
• assess-for-early-release-and-delius
• assessment-summary-and-delius
• cas2-and-delius
• cas3-and-delius
• common-platform-and-delius
• core-person-record-and-delius
• court-case-and-delius
• create-and-vary-a-licence-and-delius
• custody-key-dates-and-delius
• domain-events-and-delius
• dps-and-delius
• effective-proposal-framework-and-delius
• external-api-and-delius
• hdc-licences-and-delius
• hmpps-auth-and-delius
• ims-and-delius
• justice-email-and-delius
• make-recall-decisions-and-delius
• manage-offences-and-delius
• manage-pom-cases-and-delius
• manage-supervision-and-delius
• manage-supervision-and-oasys
• oasys-and-delius
• offender-events-and-delius
• opd-and-delius
• pathfinder-and-delius
• pre-sentence-reports-to-delius
• prison-case-notes-to-probation
• prison-custody-status-to-delius
• prison-education-and-delius
• prison-identifier-and-delius
• prisoner-profile-and-delius
• probation-search-and-delius
• refer-and-monitor-and-delius
• resettlement-passport-and-delius
• risk-assessment-scores-to-delius
• sentence-plan-and-delius
• sentence-plan-and-oasys
• soc-and-delius
• subject-access-requests-and-delius
• tier-to-delius
• unpaid-work-and-delius
• workforce-allocations-to-delius

Locations:

• io.netty:netty-common:4.1.114.Final (agent/agent.jar)
• io.netty:netty-common:4.1.114.Final (app/libs/netty-common-4.1.114.Final.jar)

References:

• https://access.redhat.com/security/cve/CVE-2024-47535
• https://github.com/netty/netty
• netty/netty@fbf7a70
• GHSA-xq3w-v528-46rv
• https://nvd.nist.gov/vuln/detail/CVE-2024-47535
• https://www.cve.org/CVERecord?id=CVE-2024-47535