[FLUME-3363] CVE-2019-20445

• Type: Improvement
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.9.0
• Fix Version/s: 1.10.0
• Component/s: Channel
• Labels: Upgrade netty version
• Assignee: Unassigned
• Reporter: dlzp
• Created: 10/Apr/20 09:48
• Updated: 01/Feb/22 20:21
• Resolved: 25/Jan/22 02:42

Description

flume-ng-core-1.9.0 requires the Netty component, and the required version is as follows:
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty</artifactId>
<version>3.10.6.Final</version>
</dependency>
I think we should upgrade Netty to its latest version: netty-4.1.45.Final. The reasons are as follows:
The CVE-2019-20445 vulnerability exists in netty-3.10.6.Final: HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. For details see: https://nvd.nist.gov/vuln/detail/CVE-2019-20445
 

Issue Links

• is duplicated by: FLUME-3385 flume-ng-sdk uses Avro-IPC version with vulnerable version of Jetty
• is duplicated by: FLUME-3386 flume-ng-sdk uses vulnerable version of netty