SUSE-SU-2022:1271-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2022/suse-su-20221271-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2022:1271-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2022:1271-1
Related
Published
2022-04-20T07:03:12Z
Modified
2022-04-20T07:03:12Z
Summary
Security update for netty
Details

This update for netty fixes the following issues:

  • Updated to version 4.1.75:
    • CVE-2021-37136: Fixed an unrestricted decompressed data size in Bzip2Decoder (bsc#1190610).
    • CVE-2021-37137: Fixed an unrestricted chunk length in SnappyFrameDecoder, which might lead to excessive memory usage (#bsc#1190613).
    • CVE-2021-43797: Fixed a potential HTTP request smuggling issue due to insufficient validation against control characters (bsc#1193672).
    • CVE-2021-21290: Fixed an information disclosure via the local system temporary directory (bsc#1182103).
References

Affected packages

openSUSE:Leap 15.3 / netty

Package

Name
netty
Purl
pkg:rpm/opensuse/netty&distro=openSUSE%20Leap%2015.3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.75-150200.4.6.2

Ecosystem specific 

{
    "binaries": [
        {
            "netty": "4.1.75-150200.4.6.2",
            "netty-javadoc": "4.1.75-150200.4.6.2",
            "netty-poms": "4.1.75-150200.4.6.2"
        }
    ]
}