Detections
Analytics
SCA: security update for io.netty:netty-handler (GHSA-6mjq-h674-j845)
medium Tenable Self-Hosted Container Security Plugin ID 411535
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Netty is an asynchronous event-driven network application framework for rapid development of maintainable
high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each
channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be
used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a
handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server
name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the
`ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but
there are not checks done here and the way the code is written, it is possible to craft a packet that
makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final.
(CVE-2023-34462)
See Also
Plugin Details
Severity: Medium
ID: 411535
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.7
Percentile: 96.54
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2023-34462
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/20/2023
Vulnerability Publication Date: 6/20/2023
Reference Information
CVE: CVE-2023-34462