[HADOOP-18578] Bump netty to the latest 4.1.86

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.4.0, 3.2.4, 3.3.4
• Component/s: build
• Labels: pull-request-available transitive-cve
• Assignee: Unassigned
• Reporter: Donghyun Kim
• Created: 16/Dec/22 07:19
• Updated: 12/Jun/23 21:56
• Resolved: 17/Mar/23 13:19

Description

Netty 4.1.86 fixes the following vulnerabilities.

• HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)
• HTTP Response splitting from assigning header value iterator (CVE-2022-41915)

For more details: https://netty.io/news/2022/12/12/4-1-86-Final.html

Issue Links

• duplicates: HADOOP-18646 Upgrade Netty to 4.1.89.Final
• links to: GitHub Pull Request #5229