Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade netty version to fix CVE #17515

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

ashibhardwaj
Copy link

Upgrading Netty from version 4.1.108.Final to 4.1.115.Final to fix CVE-2024-47535.

Refer: https://avd.aquasec.com/nvd/cve-2024-47535
(netty: Denial of Service attack on windows app using Netty)

Copy link
Contributor

@cryptoe cryptoe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will merge post a clean run of CICD

@ashibhardwaj
Copy link
Author

@cryptoe can you confirm if the above tests are failing due to transient errors? I noticed that different tests have been failing for subsequent runs.

Error:
```

Error: found 2 missing licenses. These licenses are reported, but missing in the registry
druid_module: azure-extensions, groupId: io.netty, artifactId: netty-tcnative-boringssl-static, version: 2.0.69.Final, license: Apache License version 2.0
druid_module: azure-extensions, groupId: io.netty, artifactId: netty-tcnative-classes, version: 2.0.69.Final, license: Apache License version 2.0
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants