USN-7284-1: Netty vulnerabilities

USN-7284-1: Netty vulnerabilities
24 February 2025

Several security issues were fixed in Netty.

Releases
Ubuntu 24.10 Ubuntu 24.04 LTS Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 18.04 ESM Ubuntu 16.04 ESM

Packages
netty - Java NIO client/server socket framework

Details
Jonathan Leitschuh discovered that Netty did not correctly handle file
permissions when writing temporary files. An attacker could possibly use
this issue to leak sensitive information. (CVE-2022-24823)

It was discovered that Netty did not correctly handle limiting the number
of fields when decoding a HTTP request. An attacker could possibly use
issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-29025)

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• libnetty-java - 1:4.1.48-10ubuntu0.1
  Ubuntu 24.04
• libnetty-java - 1:4.1.48-9ubuntu0.1~esm1
  Ubuntu 22.04
• libnetty-java - 1:4.1.48-4+deb11u2ubuntu0.1~esm1
  Ubuntu 20.04
• libnetty-java - 1:4.1.45-1ubuntu0.1~esm2
  Ubuntu 18.04
• libnetty-java - 1:4.1.7-4ubuntu0.1+esm3
  Ubuntu 16.04
• libnetty-java - 1:4.0.34-1ubuntu0.1~esm2

In general, a standard system update will make all the necessary changes.