Abhishek Singh created CASSANDRA-15414:
------------------------------------------
Summary: sonatype-2018-0119 (Netty is vulnerable to a Denial of Service (DoS)
attack)
Key: CASSANDRA-15414
URL: https://issues.apache.org/jira/browse/CASSANDRA-15414
Project: Cassandra
Issue Type: Bug
Reporter: Abhishek Singh
*Description :*
*Severity :* Sonatype CVSS 3.0: 7.5
*Weakness :* Sonatype CWE: 400
*Source :* Sonatype Data Research
*Categories :* Data
*Explanation :* Netty is vulnerable to a Denial of Service (DoS) attack.The OpenSslEngine
class does not have a mechanism to reject remotely initiated SSL renegotiation requests.An
attacker can exploit this vulnerability by sending a large number of SSL renegotiation requests,
causing the application to attempt to process all of them and tying up CPU and memory resources
until the application becomes unresponsive or crashed, resulting in a Denial of Service.
*Detection :* The application is vulnerable by using this component.
*Recommendation :* We recommend upgrading to a version of this component that is not vulnerable
to this specific issue.
*Root Cause :* Cassandra-2.2.5.nupkgOpenSslServerContext.class : [4.0.20.Final, 4.0.25.Final)
*Advisories :* Project: [https://github.com/netty/netty/pull/3750]
*CVSS Details :* Sonatype CVSS 3.0: 7.5
Occurences (Paths) : [" apache-cassandra.zip/bin/cassandra.in.bat" ; " apache-cassandra.zip/bin/cassandra.in.sh"
;" apache-cassandra.zip/bin/cqlsh.bat" ; " apache-cassandra.zip/bin/debug-cql.bat" ; " apache-cassandra.zip/bin/source-conf.ps1"
; " apache-cassandra.zip/bin/sstableloader.bat" ; " apache-cassandra.zip/bin/sstablescrub.bat"
; " apache-cassandra.zip/bin/sstableupgrade.bat" ; " apache-cassandra.zip/bin/sstableverify.bat"
; " apache-cassandra.zip/bin/stop-server" ; " apache-cassandra.zip/bin/stop-server.bat" ;
" apache-cassandra.zip/bin/stop-server.ps1" ; " apache-cassandra.zip/conf/README.txt" ; "
apache-cassandra.zip/conf/cassandra-rackdc.properties" ; " apache-cassandra.zip/conf/cassandra-topology.properties"
; " apache-cassandra.zip/conf/commitlog_archiving.properties" ; " apache-cassandra.zip/conf/triggers/README.txt"
; " apache-cassandra.zip/lib/ST4-4.0.8.jar" ; " apache-cassandra.zip/lib/airline-0.6.jar"
; " apache-cassandra.zip/lib/antlr-runtime-3.5.2.jar" ; " apache-cassandra.zip/lib/commons-cli-1.1.jar"
; " apache-cassandra.zip/lib/commons-lang3-3.1.jar" ; " apache-cassandra.zip/lib/commons-math3-3.2.jar"
; " apache-cassandra.zip/lib/compress-lzf-0.8.4.jar" ; " apache-cassandra.zip/lib/concurrentlinkedhashmap-lru-1.4.jar"
; " apache-cassandra.zip/lib/disruptor-3.0.1.jar" ; " apache-cassandra.zip/lib/ecj-4.4.2.jar"
; " apache-cassandra.zip/lib/futures-2.1.6-py2.py3-none-any.zip" ; " apache-cassandra.zip/lib/high-scale-lib-1.0.6.jar"
; " apache-cassandra.zip/lib/jamm-0.3.0.jar" ; " apache-cassandra.zip/lib/javax.inject.jar"
; " apache-cassandra.zip/lib/jbcrypt-0.3m.jar" ; " apache-cassandra.zip/lib/jcl-over-slf4j-1.7.7.jar"
; " apache-cassandra.zip/lib/joda-time-2.4.jar" ; " apache-cassandra.zip/lib/json-simple-1.1.jar"
; " apache-cassandra.zip/lib/libthrift-0.9.2.jar" ; " apache-cassandra.zip/lib/licenses/ST4-4.0.8.txt"
; " apache-cassandra.zip/lib/licenses/antlr-runtime-3.5.2.txt" ; " apache-cassandra.zip/lib/licenses/compress-lzf-0.8.4.txt"
; " apache-cassandra.zip/lib/licenses/concurrent-trees-2.4.0.txt" ; " apache-cassandra.zip/lib/licenses/ecj-4.4.2.txt"
; " apache-cassandra.zip/lib/licenses/futures-2.1.6.txt" ; " apache-cassandra.zip/lib/licenses/high-scale-lib-1.0.6.txt"
; " apache-cassandra.zip/lib/licenses/jbcrypt-0.3m.txt" ; " apache-cassandra.zip/lib/licenses/jcl-over-slf4j-1.7.7.txt"
; " apache-cassandra.zip/lib/licenses/jna-4.2.2.txt" ; " apache-cassandra.zip/lib/licenses/jstackjunit-0.0.1.txt"
; " apache-cassandra.zip/lib/licenses/log4j-over-slf4j-1.7.7.txt" ; " apache-cassandra.zip/lib/licenses/logback-classic-1.1.3.txt"
; " apache-cassandra.zip/lib/licenses/logback-core-1.1.3.txt" ; " apache-cassandra.zip/lib/licenses/lz4-1.3.0.txt"
; " apache-cassandra.zip/lib/licenses/metrics-core-3.1.0.txt" ; " apache-cassandra.zip/lib/licenses/metrics-jvm-3.1.0.txt"
; " apache-cassandra.zip/lib/licenses/ohc-0.4.4.txt" ; " apache-cassandra.zip/lib/licenses/reporter-config-base-3.0.3.txt"
; " apache-cassandra.zip/lib/licenses/reporter-config3-3.0.3.txt" ; " apache-cassandra.zip/lib/licenses/sigar-1.6.4.txt"
; " apache-cassandra.zip/lib/licenses/six-1.7.3.txt" ; " apache-cassandra.zip/lib/licenses/slf4j-api-1.7.7.txt"
; " apache-cassandra.zip/lib/licenses/stream-2.5.2.txt" ; " apache-cassandra.zip/lib/log4j-over-slf4j-1.7.7.jar"
; " apache-cassandra.zip/lib/logback-classic-1.1.3.jar" ; " apache-cassandra.zip/lib/logback-core-1.1.3.jar"
; " apache-cassandra.zip/lib/lz4-1.3.0.jar" ; " apache-cassandra.zip/lib/metrics-core-3.1.0.jar"
; " apache-cassandra.zip/lib/metrics-logback-3.1.0.jar" ; " apache-cassandra.zip/lib/sigar-1.6.4.jar"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-amd64-freebsd-6.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-amd64-linux.so"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-amd64-solaris.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-ia64-hpux-11.sl"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-ia64-linux.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-pa-hpux-11.sl"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-ppc-aix-5.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-ppc-linux.so"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-ppc64-aix-5.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-ppc64-linux.so"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-s390x-linux.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-sparc-solaris.so"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-sparc64-solaris.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-universal-macosx.dylib"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-universal64-macosx.dylib" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-x86-freebsd-5.so"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-x86-freebsd-6.so" ; " apache-cassandra.zip/lib/sigar-bin/libsigar-x86-linux.so"
; " apache-cassandra.zip/lib/sigar-bin/libsigar-x86-solaris.so" ; " apache-cassandra.zip/lib/sigar-bin/sigar-amd64-winnt.dll"
; " apache-cassandra.zip/lib/sigar-bin/sigar-x86-winnt.dll" ; " apache-cassandra.zip/lib/sigar-bin/sigar-x86-winnt.lib"
; " apache-cassandra.zip/lib/six-1.7.3-py2.py3-none-any.zip" ; " apache-cassandra.zip/lib/slf4j-api-1.7.7.jar"
; " apache-cassandra.zip/lib/snakeyaml-1.11.jar" ; " apache-cassandra.zip/lib/snappy-java-1.1.1.7.jar"
; " apache-cassandra.zip/lib/stream-2.5.2.jar" ; " apache-cassandra.zip/lib/thrift-server-0.3.7.jar"
; " apache-cassandra.zip/pylib/cqlshlib/__init__.py" ; " apache-cassandra.zip/pylib/cqlshlib/saferscanner.py"
; " apache-cassandra.zip/pylib/cqlshlib/sslhandling.py" ; " apache-cassandra.zip/pylib/cqlshlib/test/ansi_colors.py"
; " apache-cassandra.zip/pylib/cqlshlib/test/basecase.py" ; " apache-cassandra.zip/pylib/cqlshlib/test/test_cql_parsing.py"
; " apache-cassandra.zip/pylib/cqlshlib/test/test_cqlsh_commands.py" ; " apache-cassandra.zip/pylib/cqlshlib/test/test_cqlsh_invocation.py"
; " apache-cassandra.zip/pylib/cqlshlib/test/test_cqlsh_parsing.py" ; " apache-cassandra.zip/pylib/cqlshlib/test/winpty.py"
; " apache-cassandra.zip/tools/bin/cassandra-stress.bat" ; " apache-cassandra.zip/tools/bin/cassandra.in.bat"
; " apache-cassandra.zip/tools/bin/cassandra.in.sh" ; " apache-cassandra.zip/tools/bin/sstableexpiredblockers.bat"
; " apache-cassandra.zip/tools/bin/sstablelevelreset.bat" ; " apache-cassandra.zip/tools/bin/sstablemetadata.bat"
; " apache-cassandra.zip/tools/bin/sstableofflinerelevel.bat" ; " apache-cassandra.zip/tools/bin/sstablerepairedset.bat"
; " apache-cassandra.zip/tools/bin/sstablesplit.bat"]
*CVE :* sonatype-2018-0119
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org
|