Vulnerability Name:

CVE-2020-11612 (CCN-180530)

Assigned:2016-12-30
Published:2016-12-30
Updated:2022-04-26
Summary:The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-770
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2020-11612

Source: XF
Type: UNKNOWN
netty-cve202011612-dos(180530)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final

Source: CCN
Type: Netty GIT Repository
Compression/Decompression Codecs should enforce memory allocation size limits #6168

Source: MISC
Type: Third Party Advisory
https://github.com/netty/netty/issues/6168

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/netty/netty/pull/9924

Source: MLIST
Type: Mailing List, Third Party Advisory
[druid-commits] 20200409 [GitHub] [druid] ccaominh opened a new pull request #9654: [Backport] Upgrade netty 4 to fix CVE-2020-11612 (#9651)

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-issues] 20200413 [jira] [Assigned] (ZOOKEEPER-3794) upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[zookeeper-commits] 20200415 [zookeeper] branch master updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[druid-commits] 20200408 [GitHub] [druid] ccaominh opened a new pull request #9651: Upgrade netty 4 to fix CVE-2020-11612

Source: MISC
Type: Mailing List, Third Party Advisory
https://lists.apache.org/thread.html/r31424427cc6d7db46beac481bdeed9a823fc20bb1b9deede38557f71@%3Cnotifications.zookeeper.apache.org%3E

Source: MLIST
Type: Mailing List, Third Party Advisory
[druid-commits] 20200409 [GitHub] [druid] jon-wei merged pull request #9651: Upgrade netty 4 to fix CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200415 Build failed in Jenkins: zookeeper-branch36-java8 #137

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200415 [GitHub] [zookeeper] eolivelli closed pull request #1319: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200504 Build failed in Jenkins: zookeeper-master-maven #784

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200415 Build failed in Jenkins: zookeeper-master-maven-jdk12 #465

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200504 Build failed in Jenkins: zookeeper-master-maven-jdk12 #490

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-issues] 20200413 [jira] [Updated] (ZOOKEEPER-3794) upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612 - fixed file rename typo

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200504 Build failed in Jenkins: zookeeper-master-maven-owasp #489

Source: MLIST
Type: Mailing List, Third Party Advisory
[pulsar-commits] 20210121 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[druid-commits] 20200409 [druid] branch 0.18.0 updated: Upgrade netty 4 to fix CVE-2020-11612 (#9651) (#9654)

Source: MLIST
Type: Mailing List, Third Party Advisory
[pulsar-commits] 20210120 [GitHub] [pulsar] fmiguelez opened a new issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[zookeeper-commits] 20200415 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-issues] 20200413 [jira] [Created] (ZOOKEEPER-3794) upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[druid-commits] 20200409 [GitHub] [druid] jon-wei merged pull request #9654: [Backport] Upgrade netty 4 to fix CVE-2020-11612 (#9651)

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612 - fixed file rename typo

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[zookeeper-commits] 20200415 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[druid-commits] 20200409 [GitHub] [druid] ccaominh commented on issue #9654: [Backport] Upgrade netty 4 to fix CVE-2020-11612 (#9651)

Source: MLIST
Type: Mailing List, Third Party Advisory
[flink-issues] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200414 [GitHub] [zookeeper] phunt commented on issue #1319: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[pulsar-commits] 20210122 [GitHub] [pulsar] hpvd commented on issue #9249: Upgrade Netty dependency in broker to solve vulnerabilities: CVE-2019-16869, CVE-2020-11612, CVE-2019-20445, CVE-2019-20444

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-issues] 20200415 [jira] [Resolved] (ZOOKEEPER-3794) upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200413 [GitHub] [zookeeper] phunt opened a new pull request #1319: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[pulsar-commits] 20200416 [GitHub] [pulsar] massakam opened a new pull request #6746: [build] Bump netty version to 4.1.48.Final

Source: MLIST
Type: Mailing List, Third Party Advisory
[flink-dev] 20200910 [jira] [Created] (FLINK-19195) question on security vulnerabilities in flink

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-notifications] 20200414 [GitHub] [zookeeper] eolivelli commented on issue #1319: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612 - fixed file rename typo

Source: MLIST
Type: Mailing List, Third Party Advisory
[zookeeper-dev] 20200413 [jira] [Created] (ZOOKEEPER-3794) upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[zookeeper-commits] 20200415 [zookeeper] branch release-3.6.1 updated: ZOOKEEPER-3794: upgrade netty to address CVE-2020-11612

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20200904 [SECURITY] [DLA 2364-1] netty security update

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-66b5f85ccc

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20201223-0001/

Source: DEBIAN
Type: Third Party Advisory
DSA-4885

Source: CCN
Type: IBM Security Bulletin 6216871 (Spectrum Scale)
A vulnerability in netty affects IBM Spectrum Scale Transparent Cloud Tiering(CVE-2020-7238)

Source: CCN
Type: IBM Security Bulletin 6256620 (Tivoli Netcool/OMNIbus)
A vulnerability have been identified in Netty shipped with IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library (CVE-2020-11612)

Source: CCN
Type: IBM Security Bulletin 6320057 (Security Guardium Insights)
IBM Security Guardium Insights is affected by Components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6320059 (Security Guardium Insights)
IBM Security Guardium Insights is affected by a Netty vulnerability

Source: CCN
Type: IBM Security Bulletin 6323043 (Operations Analytics Predictive Insights)
Vulnerability in Netty 4.1.x before 4.1.46 affects IBM Operations Analytics Predictive Insights (CVE-2020-11612)

Source: CCN
Type: IBM Security Bulletin 6338535 (Cloud Private)
IBM Cloud Private is vulnerable to a Netty vulnerability (CVE-2020-11612)

Source: CCN
Type: IBM Security Bulletin 6339733 (Netcool Agile Service Manager)
A vulnerability in Netty affects IBM Netcool Agile Service Manager

Source: CCN
Type: IBM Security Bulletin 6403860 (MaaS360 Mobile Enterprise Gateway)
IBM MaaS360 Mobile Enterprise Gateway vulnerable to denial of service (CVE-2020-11612)

Source: CCN
Type: IBM Security Bulletin 6449284 (Watson Machine Learning Server on-prem)
Netty security vulnerabilities with ZlibDecoders on IBM Watson Machine Learning Server

Source: CCN
Type: IBM Security Bulletin 6466365 (DB2 for Linux, UNIX and Windows)
Multiple vulnerabilities in dependent libraries affect IBM Db2 leading to denial of service or privilege escalation.

Source: CCN
Type: IBM Security Bulletin 6520782 (Cloud Pak for Multicloud Management)
IBM Cloud Pak for Multicloud Management Monitoring has applied security fixes for its use of Netty.io

Source: CCN
Type: IBM Security Bulletin 6830983 (Sterling Order Management)
IBM Sterling Order Management Netty 4.1.34 vulnerablity

Source: CCN
Type: IBM Security Bulletin 6831849 (Cloud Pak for Watson AIOps)
Multiple Vulnerabilities in CloudPak for Watson AIOPs

Source: N/A
Type: Patch, Third Party Advisory
N/A

Source: CCN
Type: Oracle Critical Patch Update Advisory - April 2021
Oracle Critical Patch Update Advisory - April 2021

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html

Source: CCN
Type: Oracle CPUApr2022
Oracle Critical Patch Update Advisory - April 2022

Source: MISC
Type: Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html

Source: CCN
Type: Oracle CPUJan2021
Oracle Critical Patch Update Advisory - January 2021

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Source: CCN
Type: Oracle CPUJul2021
Oracle Critical Patch Update Advisory - July 2021

Vulnerable Configuration:Configuration 1:
  • cpe:/a:netty:netty:*:*:*:*:*:*:*:* (Version >= 4.1 and < 4.1.46)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:netapp:oncommand_api_services:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
  • OR cpe:/a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_cloud_native_core_service_communication_proxy:1.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:communications_design_studio:7.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:nosql_database:*:*:*:*:*:*:*:* (Version < 20.3)
  • OR cpe:/a:oracle:siebel_core_-_server_framework:*:*:*:*:*:*:*:* (Version < 21.5)
  • OR cpe:/a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
  • OR cpe:/o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:tivoli_netcool/omnibus:8.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:linux:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:unix:*:*
  • OR cpe:/a:ibm:db2:11.1:*:*:*:*:windows:*:*
  • OR cpe:/a:ibm:operations_analytics_predictive_insights:1.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:netcool_agile_service_manager:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_private:3.2.1:cd:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_private:3.2.2:cd:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:linux:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:unix:*:*
  • OR cpe:/a:ibm:db2:11.5:*:*:*:*:windows:*:*
  • OR cpe:/a:ibm:security_guardium_insights:2.0.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:113025
    P
    		netty-4.1.60-1.4 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106469
    P
    		Security update for fetchmail (Moderate)
    2021-12-14
    BACK
    netty netty *
    debian debian linux 9.0
    debian debian linux 10.0
    fedoraproject fedora 33
    netapp oncommand api services -
    netapp oncommand insight -
    netapp oncommand workflow automation -
    oracle communications brm - elastic charging engine 12.0.0.3
    oracle communications cloud native core service communication proxy 1.5.2
    oracle communications design studio 7.4.2
    oracle nosql database *
    oracle siebel core - server framework *
    oracle webcenter portal 12.2.1.3.0
    oracle webcenter portal 12.2.1.4.0
    oracle communications messaging server 8.1
    ibm tivoli netcool/omnibus 8.1.0
    ibm db2 11.1
    ibm db2 11.1
    ibm db2 11.1
    ibm operations analytics predictive insights 1.3.6
    oracle webcenter portal 12.2.1.3.0
    ibm netcool agile service manager 1.1
    ibm cloud private 3.2.1 cd
    ibm cloud private 3.2.2 cd
    ibm db2 11.5
    ibm db2 11.5
    ibm db2 11.5
    ibm security guardium insights 2.0.1