You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by GitBox <gi...@apache.org> on 2021/02/14 20:17:57 UTC
[GitHub] [zookeeper] frederiko opened a new pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
frederiko opened a new pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604
Update Netty to 4.1.53.Final on 3.5 branch to address the vulnerability describe https://snyk.io/vuln/SNYK-JAVA-IONETTY-1020439
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] frederiko edited a comment on pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
Posted by GitBox <gi...@apache.org>.
frederiko edited a comment on pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604#issuecomment-779484849
@maoling
* Good question. I don't see anything that could have prevented to be upgraded to 4.1.59.Final. Just tried to prevent any issues and address the issue at hand. In fact, I will change to the latest.
* Yes, that can be done. ~~However, for whatever reason `mvn verify` was breaking on my machine~~. Realized that maven was not too happy with openjdk version I had. Using zulu 11 has helped.
* I don't think zookeeper uses that at all. My goal here is to have vulnerability scanning tools to get this one out of the way.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] frederiko closed pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
Posted by GitBox <gi...@apache.org>.
frederiko closed pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] frederiko commented on pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
Posted by GitBox <gi...@apache.org>.
frederiko commented on pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604#issuecomment-779531371
@maoling I have opened a new PR to address the issues above. #1605.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] frederiko commented on pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
Posted by GitBox <gi...@apache.org>.
frederiko commented on pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604#issuecomment-779484849
@maoling
* Good question. I don't see anything that could have prevented to be upgraded to 4.1.59.Final. Just tried to prevent any issues and address the issue at hand. In fact, I will change to the latest.
* Yes, that can be done. However, for whatever reason `mvn verify` was breaking on my machine
* I don't think zookeeper uses that at all. My goal here is to have vulnerability scanning tools to get this one out of the way.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] frederiko commented on pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
Posted by GitBox <gi...@apache.org>.
frederiko commented on pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604#issuecomment-780007121
Closed in favor of #1605
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] maoling commented on pull request #1604: ZOOKEEPER-4209: Update Netty to 4.1.53.Final
Posted by GitBox <gi...@apache.org>.
maoling commented on pull request #1604:
URL: https://github.com/apache/zookeeper/pull/1604#issuecomment-779215305
@frederiko
- I saw that the current latest version is [4.1.59.Final](https://mvnrepository.com/artifact/io.netty/netty-all), Why not choose this one ?
- I observe the master also has that vulnerability, we can upgrade master firstly, then apply to `branch-3.6` and `branch-3.5` at the convenience
- The vulnerability only affects the `netty-codec-http` component and ZooKeeper doesn't use that component?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org