Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
netty netty
>= 4.2.0.Final, < 4.2.16.Finalaffected< 4.1.136.Finalaffected
References
- https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg ↗
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b ↗
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 ↗
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final ↗
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final ↗