Vulnerability: Man-in-the-Middle (MitM)

[superalb21234]

Expected behavior

Actual behavior

netty-handler is vulnerable to man-in-the-middle attacks. The library uses an SSLEngine that does not verify certificate hostnames when establishing connections with clients by default. This allows an attacker to potentially intercept and modify network traffic in a successful man-in-the-middle attack.

Steps to reproduce

Minimal yet complete reproducer code (or URL to code)

Netty version

Latest version still has this vulnerability

JVM version (e.g. java -version)

OS version (e.g. uname -a)

[superalb21234]

is there a possible future fix for this vulnerability issue?
FYI: using veracode platform to find some vulnerabilities in the application

[hyperxpro]

Duplicate of #10362 #9930.

This issue will not be fixed in Netty 4.1.X. It's already scheduled for Netty 5.X in #8537.

[normanmaurer]

Yes as stated we will change this in netty 5.