Vulnerability on netty-3.10.6.Final.jar

[soumyajose0784]

Druid use both 4.1.48 and 3.10.6.Final vesrions of netty jar of which lower vesrion is security vulnerable

Affected Version

18.1

Description

Though most of the netty jars are upgraded to higher version(4.1.48) in druid latest vesrion, itstill use one jar in older vesrion(netty-3.10.6.Final.jar). And this version 3.10.6.Final has security vulnerabilities associated with it.
Anyone working on replacing netty-3.10.6.final as well to latest version?

[ananthshenoy]

@soumyajose0784 Can I start working on this?

[PavanGupta]

@soumyajose0784 Did we find any solution? As druid's latest versions continue using the vulnerable netty-3.10.6.Final jar.

[OliveBZH]

Hello, seems to be still the case today in 27.0... any solution/workaround ? @PavanGupta @ananthshenoy How did you solved that ?

[dcook-pinc]

This has been a pain point for a while.
There is an older, closed, issue around this that I check on every now and then to see if there's movement.
In that thread there is a PR linked but I haven't tested the PR or seen what the issues if any were with it.
#15651

[ashibhardwaj]

Hi, is someone aware of the current state? Are there any plans to remove netty 3 dependency entirely? Thanks

[sklochkov2]

I've filed a PR today. It ports a custom set of patches we used in order to meet the corporate CVE remediation deadlines on Druid 31.0.2 to Druid-39-current. Given that the aforementioned patched Druid version ran in production for about 7 months, maybe we can try checking if it's worth the risk.