ZOOKEEPER-3563: dependency check failing on 3.4 and 3.5 branches - CV…#1102
ZOOKEEPER-3563: dependency check failing on 3.4 and 3.5 branches - CV…#1102phunt wants to merge 2 commits into
Conversation
…E-2019-16869 on Netty Updated netty to 4.1.42.Final to address CVE-2019-16869 Change-Id: Ia14d695815143cdfcda1d2efcc0d83211cb356dd
|
Tests passed for me on my Mac. |
eolivelli
left a comment
eolivelli
left a comment
There was a problem hiding this comment.
You are committing a snapshot file. Pleaae remove it.
Do you know why owasp does not have problems on 3.6.0?
I must also note that this is a notable bump in netty version, and in my experience I saw sometimes unexpected problems with netty upgrades.
btw Tests are passing and I am using Netty 1.40 with zk 3.5 in some project, so I am confident we are doing well
|
@eolivelli I didn't notice the snapshot being committed - what's up with that? Is it a known issue or should I enter a jira? (should new/modified files be in target directory?) I'll commit an updated patch momentarily. trunk is on a newer version (but not newest) of netty for some reason compared with 3.5 - not sure why that is but probably not a good idea. That said it seems like if this is a new issue owasp should be flagging, however I did see some back/forth upstream about what version of netty this impacted. Regardless I figured we just update to the very latest netty available. |
Change-Id: Ifec29e61feba69d442a2eb9b1f52050ba4c36896
|
@phunt I think we should log a JIRA for the snapshot file. But I did not track down to the root cause, it happens when you are switching from one branch to the other one (I don't know the sequence). We should update to latest netty master branch. |
|
I will create a separate jira for the snapfile issue. PR already filed for master: #1103 |
…E-2019-16869 on Netty Updated netty to 4.1.42.Final to address CVE-2019-16869 Change-Id: Ia14d695815143cdfcda1d2efcc0d83211cb356dd Author: Patrick Hunt <phunt@apache.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Brian Nixon <brian.nixon.cs@gmail.com Closes #1102 from phunt/zk3563_br35
…E-2019-16869 on Netty Updated netty to 4.1.42.Final to address CVE-2019-16869 Change-Id: Ia14d695815143cdfcda1d2efcc0d83211cb356dd Author: Patrick Hunt <phunt@apache.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Brian Nixon <brian.nixon.cs@gmail.com Closes #1102 from phunt/zk3563_br35 (cherry picked from commit 82b04e8) Signed-off-by: Norbert Kalmar <nkalmar@apache.org>
|
Merged to 3.5 and 3.5.6 branch. Thanks @phunt , ping @eolivelli |
|
Thanks @nkalmar |
ZOOKEEPER-3563: Update Netty to fix CVE-2019-16869 …E-2019-16869 on Netty Updated netty to 4.1.42.Final to address CVE-2019-16869 Author: Patrick Hunt <phunt@apache.org> Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>, Brian Nixon <brian.nixon.cs@gmail.com Closes apache#1102 from phunt/zk3563_br35 Change-Id: Ia14d695815143cdfcda1d2efcc0d83211cb356dd
4 participants
…E-2019-16869 on Netty
Updated netty to 4.1.42.Final to address CVE-2019-16869
Change-Id: Ia14d695815143cdfcda1d2efcc0d83211cb356dd