What is CVE-2022-41881?

CVE-2022-41881 is a high-severity vulnerability in the Netty project, an event-driven asynchronous network application framework. This vulnerability can cause a StackOverflowError due to infinite recursion when parsing a malformed message, potentially leading to denial of service attacks or bypassing restrictions when used as a proxy. It affects Netty versions up to 4.1.86, Debian Linux 10.0, and Debian Linux 11.0. The issue has been patched in Netty version 4.1.86.Final.

Who is impacted by CVE-2022-41881?

CVE-2022-41881 affects users of the Netty project and those using the netty package in Debian 10 buster and Debian 11 bullseye. Affected versions include Netty up to 4.1.86, Debian 10's 1:4.1.33-1+deb10u3, and versions prior to 1:4.1.48-4+deb11u1 in Debian 11. NetApp products using Apache Netty versions prior to 4.1.68.Final are also impacted. This vulnerability can lead to denial of service attacks or bypassing restrictions when used as a proxy.

What to do if CVE-2022-41881 affected you

If you're affected by the CVE-2022-41881 vulnerability, it's crucial to take action to secure your system. Follow these simple steps to mitigate the risk:

1. Upgrade your Netty project to version 4.1.86.Final or later.

2. For Debian 10 buster users, update the netty package to version 1:4.1.33-1+deb10u3.

3. For Debian 11 bullseye users, update the netty package to version 1:4.1.48-4+deb11u1 or later.

4. NetApp product users should check the NetApp Product Security page for software fixes and updates.

5. Regularly update your software and follow security best practices to minimize future risks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-41881 vulnerability, also known as Uncontrolled Recursion, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on December 12, 2022, and the required action is to update the affected software to the fixed versions mentioned in previous sections. This will help prevent potential denial of service attacks or bypassing restrictions when used as a proxy.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-674, which is an uncontrolled recursion issue in the Netty project.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• NVD - CVE-2022-41881

• [SECURITY] [DLA 3268-1] netty security update

• December 2022 Apache Netty Vulnerabilities in NetApp Products | NetApp Product Security

• [SECURITY] [DSA 5316-1] netty security update