| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty-handler | ≥ 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final | 4.2.15.Final4.1.135.Final |
| netty | ≥ 4.2.0, < 4.2.15< 4.1.135 | 4.2.154.1.135 |
An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions.
io.netty.handler.ipfilter.IpSubnetFilterRule#compareTo(java.net.InetSocketAddress) method performs a bitwise AND between the incoming IP address and the configured networkAddress, instead of the subnetMask.
Access Control Bypass. Attacker can bypass IpSubnetFilter IPv6 access controls.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free