[jira] [Commented] (KAFKA-12583) Upgrade of netty-codec due to CVE-2021-21295

["Ismael Juma (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-12583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17313171#comment-17313171 ] 

Ismael Juma commented on KAFKA-12583:
-------------------------------------

We don't use netty for http2 in Kafka, so I don't think the CVE applies. In any case, we upgraded.

> Upgrade of netty-codec due to CVE-2021-21295
> --------------------------------------------
>
>                 Key: KAFKA-12583
>                 URL: https://issues.apache.org/jira/browse/KAFKA-12583
>             Project: Kafka
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 2.7.0
>            Reporter: Dominique Mongelli
>            Assignee: Dongjin Lee
>            Priority: Major
>
> Our security tool raised the following security flaw on kafka 2.7: [https://nvd.nist.gov/vuln/detail/CVE-2021-21295]
> It is a vulnerability related to jar *netty-codec-4.1.51.Final.jar*.
> Looking at source code, the netty-codec in trunk and 2.7.0 branches are still vulnerable.
> Based on netty issue tracker, the vulnerability is fixed in 4.1.60.Final: https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj



--
This message was sent by Atlassian Jira
(v8.3.4#803005)