Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

更新netty版本 #78

Open
wants to merge 1 commit into
base: 3.x
Choose a base branch
from
Open

更新netty版本 #78

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions cloudopt-next-web/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
dependencies {
implementation "io.vertx:vertx-web:${rootProject.property('vertx_version')}"
implementation "io.netty:netty-all:4.1.65.Final"
implementation "io.netty:netty-all:4.1.75.Final"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe Vulnerability:

pkg:maven/io.netty/netty-all@4.1.75.Final

0 Critical, 2 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components
    pkg:maven/io.netty/netty-common@4.1.75.Final
      SEVERE Vulnerabilities (1)

        [CVE-2022-24823] CWE-378: Creation of Temporary File With Insecure Permissions

        Netty is an open-source, asynchronous event-driven network application framework. The package io.netty:netty-codec-http prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own java.io.tmpdir when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user.

        CVSS Score: 5.5

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-378

    pkg:maven/io.netty/netty-handler@4.1.75.Final
      SEVERE Vulnerabilities (1)

        [sonatype-2020-0026] CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

        netty-handler - Improper Certificate Validation

        The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

        CVSS Score: 6.5

        CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

        CWE: CWE-300

Reply with "@sonatype-lift help" for info about LiftBot commands.
Reply with "@sonatype-lift ignore" to tell LiftBot to leave out the above finding from this PR.
Reply with "@sonatype-lift ignoreall" to tell LiftBot to leave out all the findings from this PR and from the status bar in Github.

When talking to LiftBot, you need to refresh the page to see its response. Click here to get to know more about LiftBot commands.

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

implementation project(":cloudopt-next-logging")
implementation project(":cloudopt-next-core")
implementation project(":cloudopt-next-json")
Expand All @@ -15,4 +15,4 @@ dependencies {
testImplementation "org.freemarker:freemarker:2.3.30"
}

description = "Cloudopt Next Web"
description = "Cloudopt Next Web"