Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update netty to 4.1.72.Final #8781

Closed
vrvs opened this issue Dec 22, 2021 · 2 comments
Closed

Update netty to 4.1.72.Final #8781

vrvs opened this issue Dec 22, 2021 · 2 comments
Labels

Comments

@vrvs
Copy link

vrvs commented Dec 22, 2021

What version of gRPC-Java are you using?
https://github.com/grpc/grpc-java/releases/tag/v1.43.1

What is your environment?
Ubuntu 20.04.3 (Azure pipelines)

PaloAltoNetworks' Prisma Cloud Scan shows some vulnerabilities in netty-codec.
The version 4.1.68.Final and later has not any high severity issues. And the 4.1.71.Final and later has none.

Vulnerabilities fixed in 4.1.68.Final: https://snyk.io/vuln/maven:io.netty%3Anetty-codec

Vulnerability fixed in 4.1.71.Final: https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-2314893

@sergiitk
Copy link
Member

This is in progress, see #8780.

@sergiitk sergiitk added the netty label Dec 22, 2021
@sergiitk sergiitk added this to the Next milestone Dec 22, 2021
@ejona86
Copy link
Member

ejona86 commented Dec 23, 2021

Closing as a duplicate of #8617 (yes, that is to upgrade to an older version of Netty, but our intention is to upgrade to 4.1.72; this can be re-opened if we don't end up upgrading to 4.1.72). Note that we recommend using grpc-netty-shaded is not vulnerable to the mentioned vulnerabilities.

When using grpc-netty, you are free to use newer versions of Netty, but recognize that regressions/incompatibilities are not as rare as we'd hope.

@ejona86 ejona86 closed this as completed Dec 23, 2021
@ejona86 ejona86 removed this from the Next milestone Dec 23, 2021
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 24, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

3 participants