[ZOOKEEPER-4755] Handle Netty CVE-2023-4586

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.7.2, 3.8.3, 3.9.1
• Labels: pull-request-available
• Assignee: Damien Diederen
• Reporter: Damien Diederen
• Created: 03/Oct/23 16:23
• Updated: 11/Oct/23 11:56
• Resolved: 03/Oct/23 18:06

Description

The dependency-check:check... check currently fails with the following:

[ERROR] netty-handler-4.1.94.Final.jar: CVE-2023-4586(6.5)

According to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4586 , CVE-2023-4586 is reserved. No fix or additional information is available as of the creation of this ticket.

We have to:

1. Temporarily suppress the check;
2. Monitor CVE-2023-4586 and apply the remediation as soon as it becomes available.

Issue Links

• links to: GitHub Pull Request #2075