[CASSANDRA-18649] netty-all vulnerability: CVE-2023-34462

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.30, 3.11.16, 4.0.11, 4.1.3, 5.0-alpha1, 5.0
• Component/s: Feature/Encryption
• Bug Category: Degradation - Resource Management
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/7150cc5b99aafa6194dbaa5b8c73dc82e33c5279

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 05/Jul/23 10:54
• Updated: 12/Sep/23 13:02
• Resolved: 06/Jul/23 15:08

Description

This is failing owasp:

https://nvd.nist.gov/vuln/detail/CVE-2023-34462

The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap.