Netty requires update to 5.0.0 to resolve vulnerability #2251

Activity

1. marcospereira commented on Nov 30, 2023

   

   marcospereira

   on Nov 30, 2023

   More actions

   According to a few comments in Netty's issue tracker, CVE-2023-4586 is a false positive:

   • [Netty 5] Enable hostname verification by default  netty/netty#8537 (comment)
   • Security Vulnerability - Common Weakness Enumeration (CWE) CWE-295 netty/netty#9930 (comment)

   And it was withdrawn:

   • Does CVE-2023-4586 affect io.netty:netty-handler:4.1.100.Final? netty/netty#13665 (comment)

   Which tool reported that to you, @BrHowell? I assume it needs to be configured to ignore that CVE.
2. marcospereira commented on Nov 30, 2023

   

   marcospereira

   on Nov 30, 2023

   More actions

   But merging #2245 would be good, though.
3. BrHowell commented on Nov 30, 2023

   

   BrHowell

   on Nov 30, 2023

   Author

   More actions

   Yes I ended up discovering that withdrawal, and so we're now ignoring the CVE as we're covered by 4.1.100.Final and up.

   I forgot about coming back to this issue to update, sorry. I'll close it.

   👍React with 👍1Reacted by Marcos Pereira
4. BrHowell

   closed this as not plannedon Nov 30, 2023
5. yawkat commented on Dec 4, 2023

   

   yawkat

   on Dec 4, 2023

   More actions

   @BrHowell please note that 4.1.100.Final does not "cover" the CVE. The relevant netty API has remained unchanged. It is simply a false positive CVE.