You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@ozone.apache.org by "Rohit Kumar (Jira)" <ji...@apache.org> on 2023/10/20 10:30:00 UTC

[jira] [Created] (HDDS-9514) Upgrade netty to 4.1.100.Final

Rohit Kumar created HDDS-9514:
---------------------------------

             Summary: Upgrade netty to 4.1.100.Final
                 Key: HDDS-9514
                 URL: https://issues.apache.org/jira/browse/HDDS-9514
             Project: Apache Ozone
          Issue Type: Task
            Reporter: Rohit Kumar
            Assignee: Rohit Kumar


Upgrade netty to 4.1.100.Final due to CVE-2023-44487

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

*Base Score:* [7.5 HIGH|https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-44487&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1&source=NIST]

There is a known exploit for this vulnerability, so we need to prioritise this despite it being a High severity CVE and not a critical.

[https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p] 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org