Skip to content

build(deps): [security] bump netty.version from 4.1.59.Final to 4.1.60.Final#2284

Merged
jknack merged 1 commit into
2.xfrom
dependabot/maven/netty.version-4.1.60.Final
Mar 10, 2021
Merged

build(deps): [security] bump netty.version from 4.1.59.Final to 4.1.60.Final#2284
jknack merged 1 commit into
2.xfrom
dependabot/maven/netty.version-4.1.60.Final

Conversation

@dependabot-preview
Copy link
Copy Markdown
Contributor

Bumps netty.version from 4.1.59.Final to 4.1.60.Final.
Updates netty-common from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-buffer from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-handler from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-transport from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-transport-native-epoll from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-codec-http from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-transport-native-kqueue from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-transport-native-epoll from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-transport-native-kqueue from 4.1.59.Final to 4.1.60.Final

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Updates netty-codec-http2 from 4.1.59.Final to 4.1.60.Final This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Possible request smuggling in HTTP/2 due missing validation

Impact

If a Content-Length header is present in the original HTTP/2 request, the field is not validated by Http2MultiplexHandler as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (HttpRequest, HttpContent, etc.) via Http2StreamFrameToHttpObjectCodec and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling.

In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked.

An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. A sample attack request looks like:

POST / HTTP/2
:authority:: externaldomain.com
Content-Length: 4

asdfGET /evilRedirect HTTP/1.1 Host: internaldomain.com

Users are only affected if all of this is true:

  • HTTP2MultiplexCodec or Http2FrameCodec is used
  • Http2StreamFrameToHttpObjectCodec is used to convert to HTTP/1.1 objects

... (truncated)

Affected versions: < 4.1.60

Commits
  • eef26e8 [maven-release-plugin] prepare release netty-4.1.60.Final
  • 23ff30c Try to stabilize docker build by using https (#11070)
  • b8d8437 [maven-release-plugin] rollback the release of netty-4.1.60.Final
  • 4f099dd [maven-release-plugin] prepare for next development iteration
  • 44e392e [maven-release-plugin] prepare release netty-4.1.60.Final
  • 89c241e Merge pull request from GHSA-wm47-8v5p-wjpj
  • bf9b90c [HttpObjectDecoder] Include hex-value of illegal whitespace char (#11067)
  • 4f49870 Always include the OS in the tcnative library name (#11064)
  • 0f12472 Allow to config dns bind address in DnsNameResolver (#11061)
  • 7d4aaa2 Support session cache for client and server when using native SSLEngine imple...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Bumps `netty.version` from 4.1.59.Final to 4.1.60.Final.

Updates `netty-common` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-buffer` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-handler` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-transport` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-transport-native-epoll` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-codec-http` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-transport-native-kqueue` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-transport-native-epoll` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-transport-native-kqueue` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Updates `netty-codec-http2` from 4.1.59.Final to 4.1.60.Final
- [Release notes](https://github.com/netty/netty/releases)
- [Commits](netty/netty@netty-4.1.59.Final...netty-4.1.60.Final)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
@dependabot-preview dependabot-preview Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code security Pull requests that address a security vulnerability labels Mar 9, 2021
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Mar 9, 2021

Kudos, SonarCloud Quality Gate passed!

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

@jknack jknack added this to the 2.9.6 milestone Mar 10, 2021
@jknack jknack merged commit 34eb70c into 2.x Mar 10, 2021
@dependabot-preview dependabot-preview Bot deleted the dependabot/maven/netty.version-4.1.60.Final branch March 10, 2021 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code security Pull requests that address a security vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant