Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Netty Netty
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
|
4.2.11.final
|
4.2.18.final
|
References 4
https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe
disclosure@vulncheck.com
https://github.com/netty/netty/commit/994e887ed9
disclosure@vulncheck.com
https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/netty-4.2.11-through-4.2.17-quic-hostname-…
disclosure@vulncheck.com