A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

Withdrawn by the publisher.

Affected: Maven: io.netty:netty-handler

## Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.

## Original Description Netty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the `5.x` release branch with no backport planned.

In the interim users are advised to enable host name validation in their configurations. See https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.

hotrod-client: Hot Rod client does not enable hostname validation when using TLS that lead to a MITM attack infinispan: Credentials returned from configuration as clear text jose4j: Insecure iteration count setting

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat JBoss Data Grid ausnutzen, um Informationen offenzulegen und einen Man in the Middle Angriff durchzuführen.