Giters

IBMStreams / streamsx.hbase

Integration of IBM Streams and Apache HBase

Home Page:http://ibmstreams.github.io/streamsx.hbase/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Vulnerability found in io.netty:netty-all

schubon opened this issue · comments

commented

Details

CVE-2019-16869

Vulnerable versions: < 4.1.42
Patched version: 4.1.42

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Remediation

Upgrade io.netty:netty-all to version 4.1.42 or later. For example:

<dependency>
  <groupId>io.netty</groupId>
  <artifactId>netty-all</artifactId>
  <version>[4.1.42,)</version>
</dependency>

Always verify the validity and compatibility of suggestions with your codebase.

commented

The pom.xml of streamsx.hbase has been adapted.
The jar library netty-all-4.0.52.Final.jar upgraded to netty-all-4.1.42.Final.jar .

commented

Correction delivered in stremsx.hbase version 3.8.1
https://github.com/IBMStreams/streamsx.hbase/releases/tag/v3.8.1

commented

As there is an appropriate release ... => closed