search

hivemq / hivemq-mqtt-client

HiveMQ MQTT Client is an MQTT 5.0 and MQTT 3.1.1 compatible and feature-rich high-performance Java client library with different API flavours and backpressure support
https://hivemq.github.io/hivemq-mqtt-client/
Apache License 2.0
860 stars 159 forks source link

Upgrade to io.netty:netty-codec-http:4.1.59.Final to solve vulnerability #503

Closed sm185360 closed 1 year ago

sm185360 commented 3 years ago

Expected behavior

No Vulnerability should be found in used libraries.

Actual behavior

Below vulnerabilities found

Severity |   | Vulnerability Id | CVSS 3 Score | CVSS 2 Score | Description (hover for full text) | Published | Top Fix -- | -- | -- | -- | -- | -- | -- | --
Medium
1.9
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
09-02-2021
Upgrade to version io.netty:netty-codec-http:4.1.59.Final
2 more fixes available
The reported vulnerability was not checked for vulnerability effectiveness and is suggested to be examined using Effective Usage Analysis.
High
7.4
An issue was found in all versions of io.netty:netty-all. Host verification in Netty is disabled by default. This can lead to MITM attack in which an attacker can forge valid SSL/TLS certificates for a different hostname in order to intercept traffic that doesn’t intend for him. This is an issue because the certificate is not matched with the host.
22-06-2020

To Reproduce

Steps

Reproducer code

Details

  • Affected HiveMQ MQTT Client version(s): 1.2.2
SgtSilvio commented 3 years ago

Hi @sm185360 this is related to #490 Here is an explanation how you can upgrade the dependency yourself until a new version is released.

themonaminor commented 2 years ago

how to upgrade in docker image no source code is available only jar file is available

hgh806 commented 2 years ago

hello I get this error when try to connect, and it happend nothing!, I get no eception or no success... just this error loged: no implementation found for int io.netty.channel.epoll.native.offsetofepolldata()

pjgg commented 1 year ago

Currently, there is another vulnerability related to io.netty:netty-codec:4.1.48.Final exposed on com.hivemq:hivemq-mqtt-client:1.3.1 that is patched in netty-codec:4.1.68.Final:

https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv

pglombardo commented 1 year ago

Hi all - thanks for pointing this out. Netty has been updated 4.1.99.Final in release 1.3.3 which is building now.

  • © Githubissues.
  • Githubissues is a development platform for aggregating issues.