Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ZOOKEEPER-4709: Upgrade Netty to 4.1.94.Final #2019

Merged
merged 2 commits into from
Jul 2, 2023

Conversation

SirOibaf
Copy link
Contributor

Addresses CVE: CVE-2023-34462

@tisonkun tisonkun requested review from symat and tisonkun June 25, 2023 22:15
Copy link
Member

@tisonkun tisonkun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you! I think it's good to go.

Copy link
Contributor

@symat symat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @SirOibaf for the PR!
I also need to have these CVEs fixed, as I am currently working on the release 3.8.2.

Unfortunately it is not enough to change the version in pom.xml. Could you also rename the netty license files (https://github.com/apache/zookeeper/tree/master/zookeeper-server/src/main/resources/lib) to have the new (4.1.94) version in the file names? There are 8 files to rename, as far as I can see.

If you can do that, then I will approve this PR and merge it to all open branches. If you don't have the time, please let me know and I am happy to make an other PR.

Thank you!!!

@SirOibaf
Copy link
Contributor Author

SirOibaf commented Jul 2, 2023

@symat - I updated the PR.

Copy link
Contributor

@symat symat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @SirOibaf for reacting so quickly! I am going to merge the PR now.

@symat symat merged commit bc7baf2 into apache:master Jul 2, 2023
13 of 14 checks passed
@symat
Copy link
Contributor

symat commented Jul 2, 2023

I merged this to branch-3.8 and master. The cherrypick failed on branch-3.7, but I don't think this is a problem (as 3.7 will be EoL soon).

@symat
Copy link
Contributor

symat commented Jul 2, 2023

I resolved the conflict, and pushed it also to branch-3.7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants