Skip to content

Commit

Permalink
Set all netty-* dependencies version to 4.1.50.Final - CVE-2019-16869 …
Browse files Browse the repository at this point in the history 
…- CWE-113

Signed-off-by: coduz <alberto.codutti@eurotech.com>
  • Loading branch information
@Coduz
Coduz committed Jun 30, 2020
1 parent 8eeffa3 commit 484438e
Show file tree
Hide file tree
Showing 2 changed files with 163 additions and 34 deletions.
10 changes: 5 additions & 5 deletions commons/pom.xml
View file
Expand Up @@ -13,7 +13,7 @@
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
<groupId>org.eclipse.kapua</groupId>
<artifactId>kapua</artifactId>
Expand Down Expand Up @@ -64,10 +64,6 @@
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
</dependency>
<dependency>
<groupId>joda-time</groupId>
<artifactId>joda-time</artifactId>
</dependency>
<dependency>
<!-- Metrics -->
<groupId>io.dropwizard.metrics</groupId>
Expand All @@ -77,6 +73,10 @@
<groupId>io.netty</groupId>
<artifactId>netty-all</artifactId>
</dependency>
<dependency>
<groupId>joda-time</groupId>
<artifactId>joda-time</artifactId>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
Expand Down
187 changes: 158 additions & 29 deletions pom.xml
View file
Expand Up @@ -86,15 +86,14 @@
<elasticsearch-client-transport.version>5.3.0</elasticsearch-client-transport.version>
<elasticsearch-client-rest.version>5.3.0</elasticsearch-client-rest.version>
<elasticsearch-netty-3.version>3.10.6.Final</elasticsearch-netty-3.version>
<elasticsearch-netty-4.version>4.1.15.Final</elasticsearch-netty-4.version>
<jackson.version>2.10.1</jackson.version> <!-- Elastic Search uses 2.8.6 -->
<log4j-api.version>2.8.2</log4j-api.version> <!-- same version used by elasticsearch -->
<log4j-to-slf4j.version>2.8.2</log4j-to-slf4j.version> <!-- same version used by elasticsearch -->
<log4j2-mock.version>0.0.1</log4j2-mock.version>
<qpid-jms-client.version>0.40.0</qpid-jms-client.version>
<qpid-proton.version>0.31.0</qpid-proton.version>
<qpid-geronimo-jms.version>1.0-alpha-2</qpid-geronimo-jms.version>
<netty-all.version>4.1.34.Final</netty-all.version>
<netty.version>4.1.50.Final</netty.version>
<quartz-scheduler.version>2.2.3</quartz-scheduler.version>
<jetty.version>9.4.12.v20180830</jetty.version>

Expand Down Expand Up @@ -1083,14 +1082,15 @@
<type>war</type>
</dependency>

<!-- -->
<!-- External dependencies -->

<dependency>
<groupId>aopalliance</groupId>
<artifactId>aopalliance</artifactId>
<version>${aopalliance.version}</version>
</dependency>

<!-- -->
<!-- Apache Commons-->
<dependency>
<groupId>commons-beanutils</groupId>
Expand Down Expand Up @@ -1398,6 +1398,7 @@
<version>${shiro.version}</version>
</dependency>

<!-- -->
<!-- Elasticsearch -->
<dependency>
<groupId>org.elasticsearch</groupId>
Expand All @@ -1423,12 +1424,6 @@
<groupId>org.elasticsearch.plugin</groupId>
<artifactId>transport-netty4-client</artifactId>
<version>${elasticsearch-client-transport.version}</version>
<exclusions>
<exclusion>
<groupId>io.netty</groupId>
<artifactId>*</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.elasticsearch.plugin</groupId>
Expand Down Expand Up @@ -1461,6 +1456,160 @@
<version>${dropwizard-metrics.version}</version>
</dependency>

<!-- -->
<!-- Netty 4 -->
<!-- Below all Netty4 artifacts are defined to force any of the Netty4 usages at the same version for all components-->
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-all</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-buffer</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-dns</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-haproxy</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-http</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-http2</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-memcache</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-mqtt</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-redis</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-smtp</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-socks</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-stomp</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-xml</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-common</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-handler</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-handler-proxy</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-resolver</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-resolver-dns</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-epoll</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-epoll</artifactId>
<version>${netty.version}</version>
<classifier>linux-aarch64</classifier>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-epoll</artifactId>
<version>${netty.version}</version>
<classifier>linux-x86_64</classifier>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-kqueue</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-kqueue</artifactId>
<version>${netty.version}</version>
<classifier>osx-x86_64</classifier>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-rxtx</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-sctp</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-udt</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-example</artifactId>
<version>${netty.version}</version>
</dependency>

<!-- -->
<!-- Jackson -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
Expand All @@ -1487,14 +1636,6 @@
<groupId>org.apache.qpid</groupId>
<artifactId>qpid-jms-client</artifactId>
<version>${qpid-jms-client.version}</version>
<exclusions>
<!-- Excluding io.netty artifacts since we are importing them separately -->
<!-- Do not remove this unless a CQ for those dependencies if files-->
<exclusion>
<groupId>io.netty</groupId>
<artifactId>*</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.apache.qpid</groupId>
Expand All @@ -1507,18 +1648,6 @@
<version>${qpid-geronimo-jms.version}</version>
</dependency>

<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-all</artifactId>
<version>${netty-all.version}</version>
</dependency>

<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-epoll</artifactId>
<version>${elasticsearch-netty-4.version}</version>
</dependency>

<!-- Logging -->
<dependency>
<groupId>org.slf4j</groupId>
Expand Down

0 comments on commit 484438e

Please sign in to comment.