CVE-2015-2156: Information Exposure in Netty

Quick answers

Is CVE-2015-2156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-2156 being exploited in the wild.

How severe is CVE-2015-2156?

Low severity, with a CVSS score of 3, published 30 June 2020.

Which products and versions are affected?

io.netty:netty (Maven) ECOSYSTEM:introduced=3.10.0,fixed=3.10.3.Final; io.netty:netty-parent (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.28.Final; org.jboss.netty:netty (Maven) ECOSYSTEM:introduced=0,fixed=3.9.8.Final.

Is there a fix for CVE-2015-2156?

Yes. io.netty:netty (Maven): upgrade to 3.10.3.Final or later; io.netty:netty-parent (Maven): upgrade to 4.0.28.Final or later; org.jboss.netty:netty (Maven): upgrade to 3.9.8.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2015-2156?

Check whether you run io.netty:netty (Maven), io.netty:netty-parent (Maven) or org.jboss.netty:netty (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• io.netty:netty (Maven): upgrade to 3.10.3.Final or later

  # set io.netty:netty to 3.10.3.Final in your pom.xml or build.gradle

• io.netty:netty-parent (Maven): upgrade to 4.0.28.Final or later

  # set io.netty:netty-parent to 4.0.28.Final in your pom.xml or build.gradle

• org.jboss.netty:netty (Maven): upgrade to 3.9.8.Final or later

  # set org.jboss.netty:netty to 3.9.8.Final in your pom.xml or build.gradle

Affected products

• io.netty:netty (Maven) ECOSYSTEM:introduced=3.10.0,fixed=3.10.3.Final
• io.netty:netty-parent (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.28.Final
• org.jboss.netty:netty (Maven) ECOSYSTEM:introduced=0,fixed=3.9.8.Final

Identifiers

• CVE-2015-2156
• GHSA-xfv3-rrfm-f2rv