CVE-2026-56820
io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek).
Açıklama
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | apache-hop, apache-hop-fips, cassandra-5.0 ve 9 tane daha | 2.18.1-r7 ve 10 tane daha |
| debian 11 | netty | düzeltme belirtilmemiş |
| debian 12 | netty | düzeltme belirtilmemiş |
| debian 13 | netty | düzeltme belirtilmemiş |
| debian 14 | netty | düzeltme belirtilmemiş |
| echo | netty | düzeltme belirtilmemiş |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop, apache-hop-fips, datahub-frontend-react ve 7 tane daha | 2.19.0-r0 ve 4 tane daha |
| rapidfort debian 12 | netty | düzeltme belirtilmemiş |
| rapidfort debian 13 | netty | düzeltme belirtilmemiş |
| wolfi | cassandra-5.0, management-api-for-apache-cassandra-5.0, tez ve 1 tane daha | 5.0.8-r12 ve 3 tane daha |
12 kaynaktaki 35 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | apache-hop | 2.18.1-r7 |
| chainguard | apache-hop-fips | 2.18.1-r5 |
| chainguard | cassandra-5.0 | 5.0.8-r12 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r7 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| chainguard | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| chainguard | pinot | 1.5.1-r3 |
| chainguard | pinot-fips | 1.5.1-r3 |
| chainguard | seata | 2.6.0-r22 |
| chainguard | tez | 0.10.5-r21 |
| chainguard | thingsboard | 4.3.1.3-r6 |
| chainguard | tinkerpop | 3.8.1-r2 |
| debian 11 | netty | düzeltme belirtilmemiş |
| debian 12 | netty | düzeltme belirtilmemiş |
| debian 13 | netty | düzeltme belirtilmemiş |
| debian 14 | netty | düzeltme belirtilmemiş |
| echo | netty | düzeltme belirtilmemiş |
| echo maven::Echo OSV | io.netty:netty-handler-ssl-ocsp | 4.1.136.Final |
| maven::GitHub Security Advisory Maven | io.netty:netty-handler-ssl-ocsp | 4.2.16.Final, 4.1.136.Final |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0-r0 |
| minimos | datahub-upgrade | 1.7.0-r0 |
| minimos | datahub-upgrade-fips | 1.7.0-r0 |
| minimos | management-api-5.0 | 0.1.124-r0 |
| minimos | management-api-fips-5.0 | 0.1.124-r0 |
| minimos | trino | 483-r0 |
| minimos | trino-fips | 483-r2 |
| rapidfort debian 12 | netty | düzeltme belirtilmemiş |
| rapidfort debian 13 | netty | düzeltme belirtilmemiş |
| wolfi | cassandra-5.0 | 5.0.8-r12 |
| wolfi | management-api-for-apache-cassandra-5.0 | 0.1.122-r2 |
| wolfi | tez | 0.10.5-r21 |
| wolfi | thingsboard | 4.3.1.3-r6 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2026-56820
- https://advisory.echohq.com/cve/CVE-2026-56820
- https://github.com/advisories/GHSA-272m-gcwp-mpwg
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final