You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@cassandra.apache.org by "Brandon Williams (Jira)" <ji...@apache.org> on 2023/07/05 10:55:00 UTC

[jira] [Created] (CASSANDRA-18649) netty-all vulnerability: CVE-2023-34462

Brandon Williams created CASSANDRA-18649:
--------------------------------------------

             Summary: netty-all vulnerability: CVE-2023-34462
                 Key: CASSANDRA-18649
                 URL: https://issues.apache.org/jira/browse/CASSANDRA-18649
             Project: Cassandra
          Issue Type: Bug
            Reporter: Brandon Williams


This is failing owasp:

https://nvd.nist.gov/vuln/detail/CVE-2023-34462

<quote>
The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap.
<quote>



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org