Netty Pull Request: Security fixes for cache poisoning, TLS parsing, and SOCKS validation

Vulnerability Overview The webpage screenshot displays a GitHub Pull Request titled "Merge changes from forks (#17213) #17217". This PR includes multiple security-related fixes, primarily addressing cache poisoning, sensitive information leakage, malformed MQTT messages, TLS record handling, SOCKS protocol validation, and trust manager configuration issues. Impact Scope 1. Cache Poisoning and Sensitive Information Leakage: Netty’s silently overwrites existing headers, which can lead to cache poisoning and sensitive information leakage. 2. Malformed MQTT Messages: may generate malformed messages when the client ID, topic, or username contains invalid characters. 3. TLS Record Handling: contains errors when processing handshake headers that span multiple TLS records. 4. SOCKS Protocol Validation: There are validation issues with the SOCKS4 and SOCKS5 protocols when handling NUL bytes and fields with lengths greater than 255. 5. Trust Manager Configuration: Certain trust manager configurations are not correctly validated, potentially leading to insecure connections. Remediation 1. Cache Poisoning and Sensitive Information Leakage: - Modification: The header is only set if it does not already exist, along with added unit tests. - Result: Cache poisoning is no longer possible. 2. Malformed MQTT Messages: - Modification: Validation is added for the client ID, topic, and username when encoding and messages. - Result: If these fields contain NUL bytes, the encoder will throw an exception. 3. TLS Record Handling: - Modification: The handshake header is read directly from the record only when a complete 4-byte header is present; otherwise, record payloads are aggregated until at least 4 bytes are available. The handshake header and body are aggregated, and slicing is performed via the 4-byte header. Tests are added for fragment sizes of 1-4. - Result: messages spanning multiple TLS records are parsed correctly. 4. SOCKS Protocol Validation: - Modification: Validation for NUL bytes and length is added for both SOCKS4 and SOCKS5 to ensure correct behavior of client and server-side encoders. Tests are added to verify correct handling of boundary conditions. - Result: Correct handling of protocol types and length processing when the integrator uses custom implementations. 5. Trust Manager Configuration: - Modification: A check is added to fail fast when the configured trust manager does not support the required validation mode. - Result: Misconfigured trust manager settings are now explicitly rejected rather than failing silently. Proof of Concept (PoC) Code or Exploit Code No specific PoC code or exploit code is included in the page. Summary This Pull Request contains multiple security-related fixes involving cache poisoning, sensitive information leakage, malformed MQTT messages, TLS record handling, SOCKS protocol validation, and trust manager configuration. The remediation measures include setting the header only when necessary, validating MQTT message fields, correctly handling TLS records, validating SOCKS protocol fields, and checking trust manager configurations. These fixes contribute to improving the system's security and stability.

Goal Reached Thanks to every supporter — we hit 100%!

Netty Pull Request: Security fixes for cache poisoning, TLS parsing, and SOCKS validation

More from this source