[
https://issues.apache.org/jira/browse/KNOX-3427?focusedWorklogId=1038808&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1038808
]
ASF GitHub Bot logged work on KNOX-3427:
----------------------------------------
Author: ASF GitHub Bot
Created on: 31/Aug/26 13:26
Start Date: 31/Aug/26 13:26
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1366:
URL: https://github.com/apache/knox/pull/1366#issuecomment-5479046346
## Test Results
3 files 3 suites 12s ⏱️
66 tests 66 ✅ 0 💤 0 ❌
77 runs 77 ✅ 0 💤 0 ❌
Results for commit 02c0d867.
[test-results]:data:application/gzip;base64,H4sIABaBlWoC/12MwQ7CIBAFf6Xh7AEqLuDPGLJAsrEthsKp8d+lTVvR25t5ySws0OBndu+ul47NhfIJriSbKU4VRV+5Pnn9AA54zAXxzzzpVQ0/RbA0/AifUky7SWVai0rt+wg24tvbuMlt3NYwjiPlCoz3yJ0GZRCdtgqQg7BBgxFKC+lv0kA9JLD3B/y3TCYAAQAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1038808)
Time Spent: 20m (was: 10m)
> Upgrade Netty to 4.1.137.Final due to CVEs
> ------------------------------------------
>
> Key: KNOX-3427
> URL: https://issues.apache.org/jira/browse/KNOX-3427
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Netty is a network application framework for development of protocol servers
> and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS
> decoder accepts a peer-declared SETTINGS entry count up to the 24-bit
> frame-length limit and materializes every unique setting ID in
> {{{}DefaultSpdySettingsFrame{}}}, allowing a remote SPDY/3.1 peer to send a
> syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map
> entries and amplifies network input into heap growth and ordered-map
> insertion work. This issue is fixed in versions 4.1.136.Final and
> 4.2.16.Final.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
