Improper Validation of Certificate with Host Mismatch Affecting io.netty:netty-handler package, versions [,4.1.137.Final)[4.2.0.Final,4.2.17.Final)

io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch through the OpenSSL client path in ReferenceCountedOpenSslClientContext and related OpenSSL SSL context handling. An attacker can present a certificate for a different hostname and have the connection accepted by a client using SslProvider.OPENSSL with a plain X509TrustManager. When hostname verification is requested on that OpenSSL client path, the connection proceeds without enforcing the peer hostname check, allowing man-in-the-middle interception of TLS traffic. This affects applications that rely on Netty’s OpenSSL provider for outbound TLS connections and leaves users exposed to impersonation and data disclosure.

• GitHub Commit netty-4.1.137.Final
• GitHub Commit netty-4.2.17.Final
• Maintainer's Advisory