Yet Another Java Service Wrapper / Patches / #36 netty-common-4.1.114.Final vulnerability

#36 netty-common-4.1.114.Final vulnerability

Milestone: Any

Status: closed-fixed

Owner: nobody

Labels: None

Priority: 5

Updated: 2025-09-19

Created: 2025-01-13

Creator: A Yarborough

Private: No

netty-common-4.1.114.Final vulnerability

Whitesource (Mend) Scan as of 12/2024:

yajsw v13.13

CVSS 3 Score: 5.5 CVSS 2 Score 5.5

Found in: yajsw\lib\core\netty\netty-common-4.1.114.Final.jar

CVE-2024-47535 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47535

“Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

Discussion

A Yarborough - 2025-01-13

jre8 contines to live (being patched with jre11 and up). Please consider yajsw v13.14 with the netty* updated. Thank you.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

rzo - 2025-01-27

status: open --> open-accepted
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

rzo - 2025-01-27

thanks for pointing this out.
yes. next release will support jdk8 and resolve this issue.

👍
1

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ravi Raj - 2025-02-17

Any expected date on the 13.14 GA?

CVE detected: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24970
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25193

Fix is available in Netty:4.1.118 Final

Last edit: Ravi Raj 2025-02-17

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

A Yarborough - 2025-08-26

netty* v4.1.118 is included with yajsw v13.15. Thank you, rzo!

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

rzo - 2025-09-19

status: open-accepted --> closed-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

netty-common-4.1.114.Final vulnerability

Install java, groovy and native applications as services or daemons

Group

Searches

Help

#36 netty-common-4.1.114.Final vulnerability

Discussion