Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Possible DoS by CPU exhaustion when using malicious SSL packets #2562

Closed
normanmaurer opened this issue Jun 11, 2014 · 3 comments
Closed

Possible DoS by CPU exhaustion when using malicious SSL packets #2562

normanmaurer opened this issue Jun 11, 2014 · 3 comments
Labels
defect security
Milestone
3.9.2.Final

Comments

@normanmaurer
Copy link
Member

It was discovered that when handling specifically crafted SSL packets, the SslHandler implementation in Netty entered an infinite loop. An unauthenticated remote attacker could use this flaw to trigger a denial of service by CPU exhaustion.
@normanmaurer normanmaurer added this to the 3.9.2.Final milestone Jun 11, 2014
@normanmaurer
Copy link
Member Author

CVE-2014-3488 was assigned for it.

This issue only affects users of previous netty 3.9.x releases.

@normanmaurer
Copy link
Member Author

Fixed by 2fa9400

@cplvic
Copy link

cplvic commented Nov 16, 2017 •
edited
Loading

HI @normanmaurer .. if we are not configured to handle SSLv3 or even TLS 1.0, can you clarify if the attacker can exploit this CVE?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
defect security
Projects
None yet
Milestone
3.9.2.Final
Development

No branches or pull requests
2 participants
@normanmaurer @cplvic