There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty project is an event-driven asynchronous network application framework. Starting in version
    4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of
    values, header value validation was not performed, allowing malicious header values in the iterator to
    perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work
    around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a
    `remove()` call, and call `add()` in a loop over the iterator of values. (CVE-2022-41915)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6049-1 advisory.

    It was discovered that Netty's Zlib decoders did not limit memory allocations. A remote attacker could     possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a denial of     service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-11612)

    It was discovered that Netty created temporary files with excessive permissions. A local attacker could     possibly use this issue to expose sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu     18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)

    It was discovered that Netty did not properly validate content-length headers. A remote attacker could     possibly use this issue to smuggle requests. This issue was only fixed in Ubuntu 20.04 ESM.
    (CVE-2021-21295, CVE-2021-21409)

    It was discovered that Netty's Bzip2 decompression decoder did not limit the decompressed output data     size. A remote attacker could possibly use this issue to cause Netty to exhaust memory via malicious     input, leading to a denial of service. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu     22.04 LTS, and Ubuntu 22.10. (CVE-2021-37136)

    It was discovered that Netty's Snappy frame decoder function did not limit chunk lengths. A remote     attacker could possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a     denial of service. (CVE-2021-37137)

    It was discovered that Netty did not properly handle control chars at the beginning and end of header     names. A remote attacker could possibly use this issue to smuggle requests. This issue only affected     Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-43797)

    It was discovered that Netty could be made into an infinite recursion when parsing a malformed crafted     message. A remote attacker could possibly use this issue to cause Netty to crash, leading to a denial of     service. This issue only affected Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41881)

    It was discovered that Netty did not validate header values under certain circumstances. A remote attacker     could possibly use this issue to perform HTTP response splitting via malicious header values. This issue     only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41915)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2096-1 advisory.

    netty:

    - Security fixes included in this version update from 4.1.75 to 4.1.90:
      * CVE-2022-24823: Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary     files for         Java 6 and lower in io.netty:netty-codec-http (bsc#1199338)
      * CVE-2022-41881: HAProxyMessageDecoder Stack Exhaustion DoS (bsc#1206360)
      * CVE-2022-41915: HTTP Response splitting from assigning header value iterator (bsc#1206379)

    - Other non-security bug fixes included in this version update from 4.1.75 to 4.1.90:
      * Build with Java 11 on ix86 architecture in order to avoid build failures
      * Fix `HttpHeaders.names` for non-String headers
      * Fix `FlowControlHandler` behaviour to pass read events when auto-reading is turned off
      * Fix brotli compression
      * Fix a bug in FlowControlHandler that broke auto-read
      * Fix a potential memory leak bug has been in the pooled allocator
      * Fix a scalability issue caused by instanceof and check-cast checks that lead to false-sharing on the         `Klass::secondary_super_cache` field in the JVM
      * Fix a bug in our `PEMParser` when PEM files have multiple objects, and `BouncyCastle` is on the     classpath
      * Fix several `NullPointerException` bugs
      * Fix a regression `SslContext` private key loading
      * Fix a bug in `SslContext` private key reading fall-back path
      * Fix a buffer leak regression in `HttpClientCodec`
      * Fix a bug where some `HttpMessage` implementations, that also implement `HttpContent`, were not     handled correctly
      * Fix epoll bug when receiving zero-sized datagrams
      * Fix a bug in `SslHandler` so `handlerRemoved` works properly even if `handlerAdded` throws an     exception
      * Fix an issue that allowed the multicast methods on `EpollDatagramChannel` to be called outside of an     event-loop         thread
      * Fix a bug where an OPT record was added to DNS queries that already had such a record
      * Fix a bug that caused an error when files uploaded with HTTP POST contained a backslash in their name
      * Fix an issue in the `BlockHound` integration that could occasionally cause NetUtil to be reported as     performing         blocking operation. A similar `BlockHound` issue was fixed for the `JdkSslContext`
      * Fix a bug that prevented preface or settings frames from being flushed, when an HTTP2 connection was     established         with prior-knowledge
      * Fix a bug where Netty fails to load a shaded native library
      * Fix and relax overly strict HTTP/2 header validation check that was rejecting requests from Chrome and     Firefox
      * Fix OpenSSL and BoringSSL implementations to respect the `jdk.tls.client.protocols` and     `jdk.tls.server.protocols`         system properties, making them react to these in the same way the JDK SSL provider does
      * Fix inconsitencies in how `epoll`, `kqueue`, and `NIO` handle RDHUP
      * For a more detailed list of changes please consult the official release notes:
        -  Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1-90-Final.html
        -  Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1-89-Final.html
        -  Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1-88-Final.html
        -  Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1-87-Final.html
        -  Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1-86-Final.html
        -  Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1-85-Final.html
        -  Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1-84-Final.html
        -  Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1-82-Final.html
        -  Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1-81-Final.html
        -  Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1-80-Final.html
        -  Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1-79-Final.html
        -  Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1-78-Final.html
        -  Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1-77-Final.html
        -  Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1-76-Final.html

    netty-tcnative:

    - New artifact named `netty-tcnative-classes`, provided by this update is required by netty 4.1.90 which     contains       important security updates
    - No formal changelog present. This artifact is closely bound to the netty releases

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle TimesTen installed on the remote host is 22.x prior to 22.1.1.7.0.
It is, therefore, affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory

  - Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB (Dell BSAFE Micro Edition Suite)).     Supported versions that are affected are 22.1.1.1.0 - 22.1.1.6.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle TimesTen In-Memory     Database. (CVE-2020-35168)

  - Security-in-Depth issue in Oracle TimesTen In-Memory Database (component: EM TimesTen plug-in (Netty)).     (CVE-2022-41881)

  - Security-in-Depth issue in Oracle TimesTen In-Memory Database (component: EM TimesTen plug-in (Golang Go)).
    (CVE-2023-24532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2096-2 advisory.

    netty:

    - Security fixes included in this version update from 4.1.75 to 4.1.90:
      * CVE-2022-24823: Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary     files for         Java 6 and lower in io.netty:netty-codec-http (bsc#1199338)
      * CVE-2022-41881: HAProxyMessageDecoder Stack Exhaustion DoS (bsc#1206360)
      * CVE-2022-41915: HTTP Response splitting from assigning header value iterator (bsc#1206379)

    - Other non-security bug fixes included in this version update from 4.1.75 to 4.1.90:
      * Build with Java 11 on ix86 architecture in order to avoid build failures
      * Fix `HttpHeaders.names` for non-String headers
      * Fix `FlowControlHandler` behaviour to pass read events when auto-reading is turned off
      * Fix brotli compression
      * Fix a bug in FlowControlHandler that broke auto-read
      * Fix a potential memory leak bug has been in the pooled allocator
      * Fix a scalability issue caused by instanceof and check-cast checks that lead to false-sharing on the         `Klass::secondary_super_cache` field in the JVM
      * Fix a bug in our `PEMParser` when PEM files have multiple objects, and `BouncyCastle` is on the     classpath
      * Fix several `NullPointerException` bugs
      * Fix a regression `SslContext` private key loading
      * Fix a bug in `SslContext` private key reading fall-back path
      * Fix a buffer leak regression in `HttpClientCodec`
      * Fix a bug where some `HttpMessage` implementations, that also implement `HttpContent`, were not     handled correctly
      * Fix epoll bug when receiving zero-sized datagrams
      * Fix a bug in `SslHandler` so `handlerRemoved` works properly even if `handlerAdded` throws an     exception
      * Fix an issue that allowed the multicast methods on `EpollDatagramChannel` to be called outside of an     event-loop         thread
      * Fix a bug where an OPT record was added to DNS queries that already had such a record
      * Fix a bug that caused an error when files uploaded with HTTP POST contained a backslash in their name
      * Fix an issue in the `BlockHound` integration that could occasionally cause NetUtil to be reported as     performing         blocking operation. A similar `BlockHound` issue was fixed for the `JdkSslContext`
      * Fix a bug that prevented preface or settings frames from being flushed, when an HTTP2 connection was     established         with prior-knowledge
      * Fix a bug where Netty fails to load a shaded native library
      * Fix and relax overly strict HTTP/2 header validation check that was rejecting requests from Chrome and     Firefox
      * Fix OpenSSL and BoringSSL implementations to respect the `jdk.tls.client.protocols` and     `jdk.tls.server.protocols`         system properties, making them react to these in the same way the JDK SSL provider does
      * Fix inconsitencies in how `epoll`, `kqueue`, and `NIO` handle RDHUP
      * For a more detailed list of changes please consult the official release notes:
        -  Changes from 4.1.90: https://netty.io/news/2023/03/14/4-1-90-Final.html
        -  Changes from 4.1.89: https://netty.io/news/2023/02/13/4-1-89-Final.html
        -  Changes from 4.1.88: https://netty.io/news/2023/02/12/4-1-88-Final.html
        -  Changes from 4.1.87: https://netty.io/news/2023/01/12/4-1-87-Final.html
        -  Changes from 4.1.86: https://netty.io/news/2022/12/12/4-1-86-Final.html
        -  Changes from 4.1.85: https://netty.io/news/2022/11/09/4-1-85-Final.html
        -  Changes from 4.1.84: https://netty.io/news/2022/10/11/4-1-84-Final.html
        -  Changes from 4.1.82: https://netty.io/news/2022/09/13/4-1-82-Final.html
        -  Changes from 4.1.81: https://netty.io/news/2022/09/08/4-1-81-Final.html
        -  Changes from 4.1.80: https://netty.io/news/2022/08/26/4-1-80-Final.html
        -  Changes from 4.1.79: https://netty.io/news/2022/07/11/4-1-79-Final.html
        -  Changes from 4.1.78: https://netty.io/news/2022/06/14/4-1-78-Final.html
        -  Changes from 4.1.77: https://netty.io/news/2022/05/06/2-1-77-Final.html
        -  Changes from 4.1.76: https://netty.io/news/2022/04/12/4-1-76-Final.html

    netty-tcnative:

    - New artifact named `netty-tcnative-classes`, provided by this update is required by netty 4.1.90 which     contains       important security updates
    - No formal changelog present. This artifact is closely bound to the netty releases

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5316 advisory.

    Several out-of-memory, stack overflow or HTTP request smuggling vulnerabilities have been discovered in     Netty, a Java NIO client/server socket framework, which may allow attackers to cause a denial of service     or bypass restrictions when used as a proxy. For the stable distribution (bullseye), these problems have     been fixed in version 1:4.1.48-4+deb11u1. We recommend that you upgrade your netty packages. For the     detailed security status of netty please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/netty

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty project is an event-driven asynchronous network application framework. Starting in version     4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of     values, header value validation was not performed, allowing malicious header values in the iterator to     perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work     around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a     `remove()` call, and call `add()` in a loop over the iterator of values. (CVE-2022-41915)

Note that Nessus relies on the presence of the package as reported by the vendor.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (JSON-java)). Supported     versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     CRM. (CVE-2020-15250, CVE-2022-45688)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core (Apache ZooKeeper)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM. (CVE-2020-36518, CVE-2020-9493, CVE-2021-21295, CVE-2021-37533, CVE-2022-2048,     CVE-2022-23307, CVE-2022-41915, CVE-2022-42003, CVE-2022-42004)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework (jQueryUI)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM accessible     data as well as unauthorized read access to a subset of Siebel CRM accessible data. (CVE-2022-31160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3268 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3268-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 11, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : netty     Version        : 1:4.1.33-1+deb10u3     CVE ID         : CVE-2021-37136 CVE-2021-37137 CVE-2021-43797 CVE-2022-41881                      CVE-2022-41915     Debian Bug     : 1027180 1014769 1001437

    Several out-of-memory, stack overflow or HTTP request smuggling vulnerabilities     have been discovered in Netty, a Java NIO client/server socket framework, which     may allow attackers to cause a denial of service or bypass restrictions when     used as a proxy.

    For Debian 10 buster, these problems have been fixed in version     1:4.1.33-1+deb10u3.

    We recommend that you upgrade your netty packages.

    For the detailed security status of netty please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/netty

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Netty project is an event-driven asynchronous network application framework. In versions prior to     4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an     infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a     custom HaProxyMessageDecoder. (CVE-2022-41881)

  - Netty project is an event-driven asynchronous network application framework. Starting in version     4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of     values, header value validation was not performed, allowing malicious header values in the iterator to     perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work     around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a     `remove()` call, and call `add()` in a loop over the iterator of values. (CVE-2022-41915)

  - A defect was discovered in the Python ssl module where there is a memory race condition with the     ssl.SSLContext methods cert_store_stats() and get_ca_certs(). The race condition can be triggered if     the methods are called at the same time as certificates are loaded into the SSLContext, such as during the     TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9,     3.12.3, and 3.13.0a5. (CVE-2024-0397)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
415754	SCA: security update for io.netty:netty-codec-http (GHSA-hh82-3pmq-7frp)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
415754	SCA: security update for io.netty:netty-codec-http (GHSA-hh82-3pmq-7frp)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
174932	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS : Netty vulnerabilities (USN-6049-1)	Nessus	Ubuntu Local Security Checks	4/28/2023	9/3/2025	medium
175387	SUSE SLED15: netty / netty-javadoc / netty-poms / netty-tcnative / etc (SUSE-SU-2023:2096-1)	Nessus	SuSE Local Security Checks	5/11/2023	6/25/2026	medium
188072	Oracle TimesTen 22.x < 22.1.1.7.0 Multiple Vulnerabilities (July 2023 CPU)	Nessus	Misc.	1/16/2024	2/25/2026	critical
177502	SUSE SLED15: netty / netty-javadoc / netty-poms / netty-tcnative / etc (SUSE-SU-2023:2096-2)	Nessus	SuSE Local Security Checks	6/22/2023	6/25/2026	medium
169929	Debian DSA-5316-1 : netty - security update	Nessus	Debian Local Security Checks	1/12/2023	6/4/2025	medium
259520	Linux Distros Unpatched Vulnerability : CVE-2022-41915	Nessus	Misc.	8/30/2025	9/2/2026	medium
212439	Oracle Siebel Server <= 23.5 (July 2023 CPU)	Nessus	Misc.	12/11/2024	12/12/2024	critical
170079	Debian dla-3268 : libnetty-java - security update	Nessus	Debian Local Security Checks	1/16/2023	6/4/2025	medium
202724	Oracle Database Server (Jul 2024 CPU)	Nessus	Databases	7/19/2024	7/23/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

medium

medium

medium

critical

medium

high