Bug#827620: netty: CVE-2016-4970: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl

[tony mancill]

On 06/18/2016 11:51 AM, Salvatore Bonaccorso wrote:
> Source: netty
> Version: 1:4.0.36-2
> Severity: important
> Tags: security upstream
> 
> Hi,
> 
> the following vulnerability was published for netty. Can you please
> double-check this issue. According the upstream all versions
> 4.0.0.Final - 4.0.36.Final and 4.1.0.Final would be affected, and
> fixed in 4.1.1.Final, according to [1].
> 
> CVE-2016-4970[0]:
> Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2016-4970
> [1] http://netty.io/news/2016/06/07/4-1-1-Final.html
> 
> Please adjust the affected versions in the BTS as needed.
> 
> Regards,
> Salvatore


Hi Salvatore,

Based on the notes in [2], I have uploaded 4.0.37 to unstable, which
should take care of the CVE in unstable and testing.  This will give the
Java Team a moment to discuss strategy regarding 4.0.x vs. 4.1.x.

I haven't seen any information as to whether this vulnerability also
affects the version in stable, 3.2.6.

Cheers,
tony

[2] http://netty.io/news/2016/06/07/4-0-37-Final.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20160618/47421d51/attachment.sig>