[
https://issues.apache.org/jira/browse/KNOX-3427?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on KNOX-3427 started by Sandor Molnar.
-------------------------------------------
> Upgrade Netty to 4.1.137.Final due to CVEs
> ------------------------------------------
>
> Key: KNOX-3427
> URL: https://issues.apache.org/jira/browse/KNOX-3427
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
>
> Netty is a network application framework for development of protocol servers
> and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS
> decoder accepts a peer-declared SETTINGS entry count up to the 24-bit
> frame-length limit and materializes every unique setting ID in
> {{{}DefaultSpdySettingsFrame{}}}, allowing a remote SPDY/3.1 peer to send a
> syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map
> entries and amplifies network input into heap growth and ordered-map
> insertion work. This issue is fixed in versions 4.1.136.Final and
> 4.2.16.Final.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
