Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address netty vulnerability: CVE-2024-29025 #6242

Closed
5 of 7 tasks
TharmiganK opened this issue Mar 27, 2024 · 0 comments · Fixed by ballerina-platform/module-ballerinax-jaeger#164
Closed
5 of 7 tasks

Comments

@TharmiganK
Copy link
Contributor

TharmiganK commented Mar 27, 2024

Description:

$ Subject

Reference: https://www.cve.org/CVERecord?id=CVE-2024-29025

Note: This is only for io.netty:netty-codec-http library

Describe your task(s)

Need to update the netty version to 4.1.108-Final and netty-tcnative version to 2.0.65.Final

  • udp (not affected - updating to avoid conflicting jars)
  • tcp (not affected - updating to avoid conflicting jars)
  • http (affected)
  • websocket (affected)
  • grpc (affected)
  • observei (seems like a test dependency - need to check)
  • jaeger (not affected - updating to avoid conflicting jars)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment