Skip to content

Commit 11d7d4f

Browse files
lhotarinikhil-ctds
authored andcommitted
[fix][sec] Upgrade Netty to 4.1.100 to address CVE-2023-44487 (apache#21397)
(cherry picked from commit aae6c71) Conflicts: buildtools/pom.xml distribution/server/src/assemble/LICENSE.bin.txt distribution/shell/src/assemble/LICENSE.bin.txt
1 parent d5526fc commit 11d7d4f

3 files changed

Lines changed: 23 additions & 22 deletions

File tree

buildtools/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@
4747
<license-maven-plugin.version>4.1</license-maven-plugin.version>
4848
<puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
4949
<maven-checkstyle-plugin.version>3.1.2</maven-checkstyle-plugin.version>
50-
<netty.version>4.1.94.Final</netty.version>
50+
<netty.version>4.1.100.Final</netty.version>
5151
<guice.version>4.2.3</guice.version>
5252
<guava.version>32.1.1-jre</guava.version>
5353
<ant.version>1.10.12</ant.version>

distribution/server/src/assemble/LICENSE.bin.txt

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ The Apache Software License, Version 2.0
265265
- com.google.code.gson-gson-2.8.9.jar
266266
- io.gsonfire-gson-fire-1.8.5.jar
267267
* Guava
268-
- com.google.guava-guava-32.1.1-jre.jar
268+
- com.google.guava-guava-32.1.2-jre.jar
269269
- com.google.guava-failureaccess-1.0.1.jar
270270
- com.google.guava-listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
271271
* J2ObjC Annotations -- com.google.j2objc-j2objc-annotations-1.3.jar
@@ -307,6 +307,7 @@ The Apache Software License, Version 2.0
307307
- io.netty-netty-transport-4.1.100.Final.jar
308308
- io.netty-netty-transport-classes-epoll-4.1.100.Final.jar
309309
- io.netty-netty-transport-native-epoll-4.1.100.Final-linux-x86_64.jar
310+
- io.netty-netty-transport-native-epoll-4.1.100.Final.jar
310311
- io.netty-netty-transport-native-unix-common-4.1.100.Final.jar
311312
- io.netty-netty-transport-native-unix-common-4.1.100.Final-linux-x86_64.jar
312313
- io.netty-netty-tcnative-boringssl-static-2.0.61.Final.jar

distribution/shell/src/assemble/LICENSE.bin.txt

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -326,7 +326,7 @@ The Apache Software License, Version 2.0
326326
* Gson
327327
- gson-2.8.9.jar
328328
* Guava
329-
- guava-32.1.1-jre.jar
329+
- guava-32.1.2-jre.jar
330330
- failureaccess-1.0.1.jar
331331
- listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
332332
* J2ObjC Annotations -- j2objc-annotations-1.3.jar
@@ -344,22 +344,22 @@ The Apache Software License, Version 2.0
344344
- commons-text-1.10.0.jar
345345
- commons-compress-1.21.jar
346346
* Netty
347-
- netty-buffer-4.1.94.Final.jar
348-
- netty-codec-4.1.94.Final.jar
349-
- netty-codec-dns-4.1.94.Final.jar
350-
- netty-codec-http-4.1.94.Final.jar
351-
- netty-codec-socks-4.1.94.Final.jar
352-
- netty-codec-haproxy-4.1.94.Final.jar
353-
- netty-common-4.1.94.Final.jar
354-
- netty-handler-4.1.94.Final.jar
355-
- netty-handler-proxy-4.1.94.Final.jar
356-
- netty-resolver-4.1.94.Final.jar
357-
- netty-resolver-dns-4.1.94.Final.jar
358-
- netty-transport-4.1.94.Final.jar
359-
- netty-transport-classes-epoll-4.1.94.Final.jar
360-
- netty-transport-native-epoll-4.1.94.Final-linux-x86_64.jar
361-
- netty-transport-native-unix-common-4.1.94.Final.jar
362-
- netty-transport-native-unix-common-4.1.94.Final-linux-x86_64.jar
347+
- netty-buffer-4.1.100.Final.jar
348+
- netty-codec-4.1.100.Final.jar
349+
- netty-codec-dns-4.1.100.Final.jar
350+
- netty-codec-http-4.1.100.Final.jar
351+
- netty-codec-socks-4.1.100.Final.jar
352+
- netty-codec-haproxy-4.1.100.Final.jar
353+
- netty-common-4.1.100.Final.jar
354+
- netty-handler-4.1.100.Final.jar
355+
- netty-handler-proxy-4.1.100.Final.jar
356+
- netty-resolver-4.1.100.Final.jar
357+
- netty-resolver-dns-4.1.100.Final.jar
358+
- netty-transport-4.1.100.Final.jar
359+
- netty-transport-classes-epoll-4.1.100.Final.jar
360+
- netty-transport-native-epoll-4.1.100.Final-linux-x86_64.jar
361+
- netty-transport-native-unix-common-4.1.100.Final.jar
362+
- netty-transport-native-unix-common-4.1.100.Final-linux-x86_64.jar
363363
- netty-tcnative-boringssl-static-2.0.61.Final.jar
364364
- netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar
365365
- netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar
@@ -370,9 +370,9 @@ The Apache Software License, Version 2.0
370370
- netty-incubator-transport-classes-io_uring-0.0.21.Final.jar
371371
- netty-incubator-transport-native-io_uring-0.0.21.Final-linux-aarch_64.jar
372372
- netty-incubator-transport-native-io_uring-0.0.21.Final-linux-x86_64.jar
373-
- netty-resolver-dns-classes-macos-4.1.94.Final.jar
374-
- netty-resolver-dns-native-macos-4.1.94.Final-osx-aarch_64.jar
375-
- netty-resolver-dns-native-macos-4.1.94.Final-osx-x86_64.jar
373+
- netty-resolver-dns-classes-macos-4.1.100.Final.jar
374+
- netty-resolver-dns-native-macos-4.1.100.Final-osx-aarch_64.jar
375+
- netty-resolver-dns-native-macos-4.1.100.Final-osx-x86_64.jar
376376
* Prometheus client
377377
- simpleclient-0.16.0.jar
378378
- simpleclient_log4j2-0.16.0.jar

0 commit comments

Comments
 (0)