Most recent entries from all

bdu:2023-07355

certfr-2024-avi-0145 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0145

EUVD-2026-261489

fkie_cve-2023-4586

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

Withdrawn: GHSA-57m8-f3v5-hm5m — Withdrawn Advisory: Netty-handler does not validate host names by default

Withdrawn by the publisher.

Affected: Maven: io.netty:netty-handler

## Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.

## Original Description Netty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the `5.x` release branch with no backport planned.

In the interim users are advised to enable host name validation in their configurations. See https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.

gsd-2023-4586

RHSA-2023:7676 — Red Hat Security Advisory: Red Hat Data Grid 8.4.6 security update

hotrod-client: Hot Rod client does not enable hostname validation when using TLS that lead to a MITM attack infinispan: Credentials returned from configuration as clear text jose4j: Insecure iteration count setting

WID-SEC-W-2023-3071 — Red Hat JBoss Data Grid: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat JBoss Data Grid ausnutzen, um Informationen offenzulegen und einen Man in the Middle Angriff durchzuführen.