Update netty to 4.1.86.Final to remediate CVE-2022-41881

[debraj-spotnana]

zipkin is getting flagged in our security scans due to the presence of io.netty:netty-codec-haproxy:4.1.78.Final which has CVE-2022-41881 .

Is there any plan to upgrade io.netty:netty-codec-haproxy to 4.1.86.Final to get around this?

[rweinsteinPGH]

My organization tagging this as well, i know netty just got updated a few months ago to 4.1.78 but needs to get updated again to clear this issue, severity is High

[jcchavezs]

Ping @llinder

…

On Fri, 3 Mar 2023, 19:38 rweinsteinPGH, ***@***.***> wrote: My organization tagging this as well, i know netty just got updated a few months ago to 4.1.78 but needs to get updated again to clear this issue, severity is High — Reply to this email directly, view it on GitHub <#3512 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAUL3TMZM7IG4I5UMHDW2I3DBANCNFSM6AAAAAAVMAKNCQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[debraj-manna]

@jcchavezs @llinder - Can you please let us know if zipkin is really effected by CVE-2022-41881 ?

[darkmastermindz]

Hi @jcchavezs @llinder

This CVE seems to be inherited from Spring Boot and resolved in Spring Boot v2.7.12.

I can confirm this is being picked up on my end as well as the only CVE left to remediate in Zipkin 2.24.2 although it uses v2.7.12 since it's specified in https://github.com/openzipkin/zipkin/blob/1acbc8651df50aa8200cbff725285a1cb1c759d9/pom.xml#LL57C1-L58C1

Opened PR with using netty 4.1.92.Final to match to see if there are any conflicts.

References:
spring-projects/spring-boot/issues/33580

[darkmastermindz]

@jcchavezs @llinder I think we should favor should bumping to 4.1.92.Final #3548 to match the current Spring Boot version.
Wanted to compare with the CI with 4.1.86.Final in #3549 - @shakuzen mentioned that there was a test broken unrelated to this change.

[codefromthecrypt]

latest version of zipkin has all netty CVEs addressed