You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@storm.apache.org by "Lativado (via GitHub)" <gi...@apache.org> on 2024/08/23 14:25:08 UTC
[PR] Uplift netty to 4.1.112 (storm)
Lativado opened a new pull request, #3685:
URL: https://github.com/apache/storm/pull/3685
## What is the purpose of the change
We have detected a CVE ([CVE-2024-29025](https://nvd.nist.gov/vuln/detail/CVE-2024-29025)) in our code and have tracked it down to the version of netty included with storm-shaded-deps. This will need to be fixed in a storm 2.6.4 release so that we can resolve this CVE by uplifting to that version.
## How was the change tested
Small dependency bump. No tests performed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "noslowerdna (via GitHub)" <gi...@apache.org>.
noslowerdna commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2329352874
@reiabreu @rzo1 We really appreciate your efforts to expedite this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu merged PR #3685:
URL: https://github.com/apache/storm/pull/3685
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307223094
Needs an update of the license file. Otherwise, Looks good to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307464997
@reiabreu I guess we need a Jira for the changelog.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "noslowerdna (via GitHub)" <gi...@apache.org>.
noslowerdna commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2313639415
Thanks very much.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "noslowerdna (via GitHub)" <gi...@apache.org>.
noslowerdna commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2327245815
@reiabreu How is the testing going? Would you be able to give us an ETA for 2.6.4's availability?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "Lativado (via GitHub)" <gi...@apache.org>.
Lativado commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307254006
Someone in my org called out a license file that I had missed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "noslowerdna (via GitHub)" <gi...@apache.org>.
noslowerdna commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307268056
@jnioche I noticed you committed the previous Netty version update. Would it be possible to prioritize getting this Netty uplift merged and released?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "noslowerdna (via GitHub)" <gi...@apache.org>.
noslowerdna commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307507224
@reiabreu I've created https://issues.apache.org/jira/browse/STORM-4078 for this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2313128261
Cheers, I will try to initiate the release sometime this week.
On Tue, 27 Aug 2024 at 17:49, Richard Zowalla ***@***.***>
wrote:
> Feel free. I might find some time to test/review but we need to keep in
> mind, that we have holiday season im the northern hemisphere, which might
> delay votes.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/storm/pull/3685#issuecomment-2313062881>, or
> unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAG5GIRA72G7QHBMMXITIPTZTSUZ7AVCNFSM6AAAAABNAJIUMWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMJTGA3DEOBYGE>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2322881276
RC1 is out for testing.
(We should improve our release notes to include dependabot's changes)
On Tue, Aug 27, 2024, 22:49 Andrew Olson ***@***.***> wrote:
> Thanks very much.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/storm/pull/3685#issuecomment-2313639415>, or
> unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAG5GITK2YCNQBHK234K2J3ZTTX7TAVCNFSM6AAAAABNAJIUMWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMJTGYZTSNBRGU>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2327277011
@noslowerdna Testing is up to the community. Feel free to subscribe to the [dev mailing list ](https://storm.apache.org/getting-help.html), try the release candidate and cast a (non-binding) vote. This is the VOTE thread: https://lists.apache.org/thread/02twpq5g4hhlwj9d86mr5cog7xyv05hc
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307480047
Good call @rzo1 .
@Lativado do you have a Jira account to report the issue? I can also do it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307528546
Thank you for that .I took the liberty of editing the issue and assigning it version 2.6.4. I reckon we can mark at as resolved if no one objects
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2313019645
I don't mind acting as a release manager for 2.6.4. But we need
consensus from maintainers to initiate the release.
On Tue, 27 Aug 2024 at 15:31, Andrew Olson ***@***.***> wrote:
>
> @rzo1 @reiabreu Do you know when 2.6.4 could be released? We have a CVE remediation checkpoint in a couple weeks, and it would be nice to be able to include this fix.
>
> —
> Reply to this email directly, view it on GitHub, or unsubscribe.
> You are receiving this because you were mentioned.Message ID: ***@***.***>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "noslowerdna (via GitHub)" <gi...@apache.org>.
noslowerdna commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2312737630
@rzo1 @reiabreu Do you know when 2.6.4 could be released? We have a CVE remediation checkpoint in a couple weeks, and it would be nice to be able to include this fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "rzo1 (via GitHub)" <gi...@apache.org>.
rzo1 commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2313062881
Feel free. I might find some time to test/review but we need to keep in mind, that we have holiday season im the northern hemisphere, which might delay votes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "Lativado (via GitHub)" <gi...@apache.org>.
Lativado commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2307242235
Updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Uplift netty to 4.1.112 (storm)
Posted by "reiabreu (via GitHub)" <gi...@apache.org>.
reiabreu commented on PR #3685:
URL: https://github.com/apache/storm/pull/3685#issuecomment-2327630209
@noslowerdna 2.6.4 has been formally released.
Cheers
On Tue, 3 Sept 2024 at 20:34, Richard Zowalla ***@***.***>
wrote:
> @noslowerdna <https://github.com/noslowerdna> Testing is up to the
> community. Feel free to subscribe to the dev mailing list
> <https://storm.apache.org/getting-help.html>, try the release candidate
> and cast a (non-binding) vote. This is the VOTE thread:
> https://lists.apache.org/thread/02twpq5g4hhlwj9d86mr5cog7xyv05hc
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/storm/pull/3685#issuecomment-2327277011>, or
> unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAG5GIQRP2323RQ7EG72KTDZUYFN3AVCNFSM6AAAAABNAJIUMWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMRXGI3TOMBRGE>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@storm.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org