Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade netty to 4.1.77 #1926

Merged
merged 1 commit into from
Jul 1, 2022
Merged

Upgrade netty to 4.1.77 #1926

merged 1 commit into from
Jul 1, 2022

Conversation

cwperks
Copy link
Member

@cwperks cwperks commented Jun 30, 2022

Signed-off-by: Craig Perkins [email protected]

Description

[Describe what this change achieves]

  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

First PR! 🥇 This upgrades Netty to address a CVE in 4.1.73. This resolves 1831

  • Why these changes are required?
  • What is the old behavior before changes and new behavior after changes?

Issues Resolved

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

This passes CI

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@cwperks cwperks requested a review from a team June 30, 2022 19:01
@codecov-commenter
Copy link

codecov-commenter commented Jun 30, 2022 •
edited
Loading

Codecov Report

Merging #1926 (5c8f9b7) into main (1904db5) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##               main    #1926   +/-   ##
=========================================
  Coverage     60.99%   60.99%           
  Complexity     3233     3233           
=========================================
  Files           256      256           
  Lines         18088    18088           
  Branches       3224     3224           
=========================================
  Hits          11033    11033           
  Misses         5471     5471           
  Partials       1584     1584

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1904db5...5c8f9b7. Read the comment docs.

peternied
peternied previously approved these changes Jun 30, 2022
View reviewed changes
Copy link
Member

@peternied peternied left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution, WhiteSource detected the fixes are in, thanks.

image

@cliu123 cliu123 added the backport 2.x backport to 2.x branch label Jun 30, 2022
@cliu123
Copy link
Member

cliu123 commented Jun 30, 2022

The CVE points to netty-common-4.1.73.Final. Is it possible only to upgrade the version of io.netty:netty-common?

@cwperks
Copy link
Member Author

cwperks commented Jul 1, 2022

@peternied I just noticed that netty is defined in core's version.properties here: https://github.com/opensearch-project/OpenSearch/blob/aa6f782dd58aa5019bcb16009182c9fc1ec9fa0e/buildSrc/version.properties

Should the security plugin use the version from this properties file? The build.gradle for security references versions.jackson and versions.jackson_databind which I believe get resolved with the values in this file at build time.

@peternied
Copy link
Member

peternied commented Jul 1, 2022 •
edited
Loading

@cwperks Good investigation, I think as we've done with capturing the jackson dependencies version from OpenSearch's versions - we should follow suite with netty. This also means that we should make sure that the CVE is addressed in the OpenSearch codebase - can you make the pull request there as well?

@cwperks
Copy link
Member Author

cwperks commented Jul 1, 2022

@peternied Will do. I'll update this thread with the PR into core when I've opened it.

@cliu123
Copy link
Member

cliu123 commented Jul 1, 2022

@cwperks Could you please sign the 2nd commits too?

@cwperks cwperks force-pushed the upgrade-netty-to-4.1.77 branch from dc786a0 to 5c8f9b7 Compare July 1, 2022 17:22
@cwperks
Copy link
Member Author

cwperks commented Jul 1, 2022

@cliu123 I shortened it to one commit and signed off.

@cliu123 cliu123 merged commit be876c0 into opensearch-project:main Jul 1, 2022
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jul 1, 2022
@cwperks @github-actions
Use version of netty from core's version.properties (#1926)
68f6308 
Signed-off-by: Craig Perkins <[email protected]>
(cherry picked from commit be876c0)
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Jul 1, 2022
Merged
opensearch-trigger-bot bot pushed a commit that referenced this pull request Jul 1, 2022
@cwperks @github-actions
Use version of netty from core's version.properties (#1926)
92edcde 
Signed-off-by: Craig Perkins <[email protected]>
(cherry picked from commit be876c0)
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Jul 1, 2022
Merged
cliu123 pushed a commit that referenced this pull request Jul 1, 2022
@opensearch-trigger-bot @cwperks
Use version of netty from core's version.properties (#1926) (#1928)
11e781d 
Signed-off-by: Craig Perkins <[email protected]>
(cherry picked from commit be876c0)

Co-authored-by: Craig Perkins <[email protected]>
cliu123 pushed a commit that referenced this pull request Jul 1, 2022
@opensearch-trigger-bot @cwperks
Use version of netty from core's version.properties (#1926) (#1929)
53faf04 
Signed-off-by: Craig Perkins <[email protected]>
(cherry picked from commit be876c0)

Co-authored-by: Craig Perkins <[email protected]>
@cwperks
Copy link
Member Author

cwperks commented Jul 5, 2022

Created a PR against core to update this across the board: opensearch-project/OpenSearch#3772

hpkuppuraj pushed a commit to hpkuppuraj/security that referenced this pull request Jul 14, 2022
@opensearch-trigger-bot @cwperks
Use version of netty from core's version.properties (opensearch-proje…
10a516b 
…ct#1926) (opensearch-project#1929)

Signed-off-by: Craig Perkins <[email protected]>
(cherry picked from commit be876c0)

Co-authored-by: Craig Perkins <[email protected]>
Signed-off-by: hari prasad <[email protected]>
stephen-crawford pushed a commit to stephen-crawford/security that referenced this pull request Nov 10, 2022
@cwperks @stephen-crawford
Use version of netty from core's version.properties (opensearch-proje…
a521673 
…ct#1926)

Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
wuychn pushed a commit to ochprince/security that referenced this pull request Mar 16, 2023
@opensearch-trigger-bot @cwperks
Use version of netty from core's version.properties (opensearch-proje…
76f7445 
…ct#1926) (opensearch-project#1928)

Signed-off-by: Craig Perkins <[email protected]>
(cherry picked from commit be876c0)

Co-authored-by: Craig Perkins <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@peternied peternied peternied approved these changes

@cliu123 cliu123 cliu123 approved these changes

Assignees
No one assigned
Labels
backport 2.x backport to 2.x branch backport 2.1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

CVE-2022-24823 (Medium) detected in netty-common-4.1.73.Final.jar
4 participants
@cwperks @codecov-commenter @cliu123 @peternied