[ATLAS-4806] Upgrade netty to 4.1.100.Final due to CVE-2023-44487

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.4.0
• Component/s: atlas-core
• Assignee: Disha Talreja
• Reporter: Disha Talreja
• Created: 30/Oct/23 19:45
• Updated: 08/Feb/24 18:34
• Resolved: 08/Feb/24 18:34

Description

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Base Score: 7.5 HIGH

There is a known exploit for this vulnerability, so we need to prioritise this despite it being a High severity CVE and not a critical.

https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p