IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-50010Netty's wrapping plain trust manager silently disables hostname verification

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1 Publicada: (hace 5 meses)

Descripción

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Debilidad (CWE): CWE-347

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amq streams 2.9 —
cryostat 4 —
jboss enterprise application platform 8.1 —
jboss enterprise application platform els 7.4 —
netty netty >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final
offline knowledge portal 1.2 —
openshift ai 2.25 —
openshift devspaces 3.30 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Red Hat AMQ Broker 7.13.6 —
Red Hat Red Hat AMQ Broker 7.14.1 —
Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 —
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 —
Red Hat Red Hat build of Quarkus 3.27.4.SP1 —
Red Hat Red Hat build of Quarkus 3.33.2.SP1 —
Red Hat Red Hat Data Grid 8.6.2 —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA all versions
Red Hat Red Hat Offline Knowledge Portal 1.2.12 all versions
Red Hat Streams for Apache Kafka 2.9.4 —

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15