[
https://issues.apache.org/jira/browse/CASSANDRA-18649?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17740275#comment-17740275
]
Brandon Williams commented on CASSANDRA-18649:
----------------------------------------------
Given that none of our netty-based services should be exposed to untrusted
networks, we can suppress this. Trunk will get an upgraded netty in
CASSANDRA-17992.
||Branch||CI||
|[3.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18649-3.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/1108/workflows/ac3c8e31-f776-49c5-9365-7654f9e7fa15]|
|[3.11|https://github.com/driftx/cassandra/tree/CASSANDRA-18649-3.11]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/1107/workflows/36e6988d-00f5-46a5-bd36-051f63a97bc0]|
|[4.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18649-4.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/1110/workflows/e32dd6d7-b99f-4764-9006-88acaece57d9],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/1110/workflows/aefd6698-3e62-452e-9b9d-d1ff5ebbf0ea]|
|[4.1|https://github.com/driftx/cassandra/tree/CASSANDRA-18649-4.1]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/1109/workflows/e8fd29d0-5166-4b86-8e8a-53a48651488a],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/1109/workflows/9d90fcd1-05c9-4c60-88c8-5e0a39dda4f4]|
|[trunk|https://github.com/driftx/cassandra/tree/CASSANDRA-18649-trunk]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/1106/workflows/6f36192a-1ced-44e2-8c9d-2e0c748af672],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/1106/workflows/17f2bfaf-2db2-4f75-839b-b121658f46ae]|
> netty-all vulnerability: CVE-2023-34462
> ---------------------------------------
>
> Key: CASSANDRA-18649
> URL: https://issues.apache.org/jira/browse/CASSANDRA-18649
> Project: Cassandra
> Issue Type: Bug
> Components: Feature/Encryption
> Reporter: Brandon Williams
> Assignee: Brandon Williams
> Priority: Normal
> Fix For: 3.0.x, 3.11.x, 4.0.x, 4.1.x, 5.x
>
>
> This is failing owasp:
> https://nvd.nist.gov/vuln/detail/CVE-2023-34462
> {quote}
> The `SniHandler` can allocate up to 16MB of heap for each channel during the
> TLS handshake. When the handler or the channel does not have an idle timeout,
> it can be used to make a TCP server using the `SniHandler` to allocate 16MB
> of heap.
> {quote}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
