Sandor Molnar created KNOX-3427:
-----------------------------------
Summary: Upgrade Netty to 4.1.137.Final due to CVEs
Key: KNOX-3427
URL: https://issues.apache.org/jira/browse/KNOX-3427
Project: Apache Knox
Issue Type: Bug
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Netty is a network application framework for development of protocol servers
and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS
decoder accepts a peer-declared SETTINGS entry count up to the 24-bit
frame-length limit and materializes every unique setting ID in
{{{}DefaultSpdySettingsFrame{}}}, allowing a remote SPDY/3.1 peer to send a
syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map
entries and amplifies network input into heap growth and ordered-map insertion
work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
