Homepage

io.netty:netty-tcnative@2.0.81.Final

  • latest version

    2.0.84.Final

  • latest non vulnerable version

    2.0.84.Final

  • first published

    12 years ago

  • latest version published

    1 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the io.netty:netty-tcnative package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Incorrect Calculation

    Affected versions of this package are vulnerable to Incorrect Calculation via the tcn_write_to_bytebuffer callback in the BIO write process. An attacker can cause queued post-handshake records to truncate flights, fail connections, or abort the JVM process by sending specially crafted TLS 1.3 messages.

    How to fix Incorrect Calculation?

    Upgrade io.netty:netty-tcnative to version 2.0.84.Final or higher.

    [,2.0.84.Final)
    • C
    Out-of-bounds Write

    Affected versions of this package are vulnerable to Out-of-bounds Write via the tcn_write_to_bytebuffer BIO callback process. An attacker can cause the JVM process to crash by sending specially crafted handshake, renegotiation, or post-handshake messages that trigger an out-of-bounds memory copy operation.

    How to fix Out-of-bounds Write?

    Upgrade io.netty:netty-tcnative to version 2.0.84.Final or higher.

    [,2.0.84.Final)
    • M
    Improper Handling of Unicode Encoding

    Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding via the NewStringUTF decoding process. An attacker can bypass host-based access controls and influence certificate selection or logging by sending specially crafted overlong UTF-8 encodings in the server_name field of the ClientHello message.

    How to fix Improper Handling of Unicode Encoding?

    Upgrade io.netty:netty-tcnative to version 2.0.84.Final or higher.

    [,2.0.84.Final)
    • H
    Use After Free

    Affected versions of this package are vulnerable to Use After Free through the ssl_tlsext_ticket_key_cb process during session ticket key rotation. An attacker can cause a crash or corrupt ticket processing by initiating TLS handshakes while setSessionTicketKeys0 frees the shared key array, leading OpenSSL to access freed HMAC keys.

    How to fix Use After Free?

    Upgrade io.netty:netty-tcnative to version 2.0.84.Final or higher.

    [,2.0.84.Final)
    Go back to all versions of this package