Към съдържанието
Търсене

CVE-2026-50010: netty, слаба криптография

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Засегнати продукти

  • netty netty: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final
  • Red Hat Cryostat 4 on RHEL 9: 4.2.0-13 преди *
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1
  • Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
  • Red Hat Red Hat build of Quarkus 3.27.4.SP1
  • Red Hat Red Hat build of Quarkus 3.33.2.SP1
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7: 0:2.16.0-22.redhat_00057.1.el7eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8: 0:2.16.0-22.redhat_00057.1.el8eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9: 0:2.16.0-22.redhat_00057.1.el9eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA: 4.1.135.Final-redhat-00001 преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: 0:801.7.1-1.GA_redhat_00001.1.el10eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: 0:801.7.1-1.GA_redhat_00001.1.el8eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: 0:801.7.1-1.GA_redhat_00001.1.el9eap преди *
  • Red Hat Streams for Apache Kafka 2.9.4
  • Red Hat Red Hat Offline Knowledge Portal 1.2.12: 1782239370 преди *
  • Red Hat Red Hat OpenShift AI 2.25: 1788198681 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.30: 1787759145 преди *
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 3

Вид слабост

История

  • 12 юни 2026 Публикувано

Други уязвимости в netty netty

Първоизточници

CVE-2026-50010: netty, слаба криптография | freedomonline.bg