CVE-2025-24970
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
7.5
HIGH
CVSS 3.1
EPSS 2.0%
描述
### Impact When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. ### Workarounds As workaround its possible to either disable the usage of the native SSLEngine or changing the code from: ``` SslContext context = ...; SslHandler handler = context.newHandler(....); ``` to: ``` SslContext context = ...; SSLEngine engine = context.newEngine(....); SslHandler handler = new SslHandler(engine, ....); ```
如何修補 CVE-2025-24970
要修補 CVE-2025-24970,請將受影響套件升級到下列已修補版本。
- —升級至 4.1.118.Final 或更新版本
CVE-2025-24970 正在被利用嗎?
低 — EPSS 為 2.0%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 4.1.91.Final, < 4.1.118.Final
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |