CVE-2026-56820
io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée), Red Hat (élevée).
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | apache-hop, apache-hop-fips, cassandra-5.0 et 9 autres | 2.18.1-r7 et 10 autres |
| debian 11 | netty | pas de correctif indiqué |
| debian 12 | netty | pas de correctif indiqué |
| debian 13 | netty | pas de correctif indiqué |
| debian 14 | netty | pas de correctif indiqué |
| echo | netty | pas de correctif indiqué |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop, apache-hop-fips, datahub-frontend-react et 7 autres | 2.19.0-r0 et 4 autres |
| rapidfort debian 12 | netty | pas de correctif indiqué |
| rapidfort debian 13 | netty | pas de correctif indiqué |
| wolfi | cassandra-5.0, management-api-for-apache-cassandra-5.0, tez et 1 autres | 5.0.8-r12 et 3 autres |
Afficher les 35 entrées de 12 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | apache-hop | 2.18.1-r7 |
| chainguard | apache-hop-fips | 2.18.1-r5 |
| chainguard | cassandra-5.0 | 5.0.8-r12 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r7 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| chainguard | pinot | 1.5.1-r3 |
| chainguard | pinot-fips | 1.5.1-r3 |
| chainguard | seata | 2.6.0-r22 |
| chainguard | tez | 0.10.5-r21 |
| chainguard | thingsboard | 4.3.1.3-r6 |
| chainguard | tinkerpop | 3.8.1-r2 |
| debian 11 | netty | pas de correctif indiqué |
| debian 12 | netty | pas de correctif indiqué |
| debian 13 | netty | pas de correctif indiqué |
| debian 14 | netty | pas de correctif indiqué |
| echo | netty | pas de correctif indiqué |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | management-api-5.0 | 0.1.124-r0 |
| minimos | management-api-fips-5.0 | 0.1.124-r0 |
| minimos | trino | 483-r0 |
| minimos | trino-fips | 483-r2 |
| rapidfort debian 12 | netty | pas de correctif indiqué |
| rapidfort debian 13 | netty | pas de correctif indiqué |
| wolfi | cassandra-5.0 | 5.0.8-r12 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| wolfi | tez | 0.10.5-r21 |
| wolfi | thingsboard | 4.3.1.3-r6 |
Références
- https://access.redhat.com/security/cve/CVE-2026-56820
- https://advisory.echohq.com/cve/CVE-2026-56820
- https://github.com/advisories/GHSA-272m-gcwp-mpwg
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final