Description
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
netty netty-tcnative
Default version status: unaffected
2.0.66.Final to < 2.0.84.Finalaffected
pkg:maven/io.netty/netty-tcnativeReferences
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw ↗
- https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118 ↗
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L1365 ↗
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final ↗
- https://github.com/netty/netty-tcnative ↗
- https://www.vulncheck.com/advisories/netty-tcnative-2.0.66-final-before-2.0.84-final-use-after-free-in-session-ticket-callback ↗