[TINKERPOP-2883] Vulnerability in Netty libraries

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 3.6.2
• Labels: Ironbank
• Flags: Patch, Important
• Assignee: Unassigned
• Reporter: Jim Foscue
• Created: 27/Feb/23 20:29
• Updated: 09/Mar/23 20:33
• Resolved: 09/Mar/23 20:33

Description

Vulnerability in netty-3.9.9

Need to update to netty libraries to greater than 4.1.44

https://nvd.nist.gov/vuln/detail/CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Issue Links

• is a clone of: TINKERPOP-2882 Vulnerability in com.hazelcase_hazelcast-3.7.8