[
https://issues.apache.org/jira/browse/FLINK-8170?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nico Kruber closed FLINK-8170.
------------------------------
Resolution: Duplicate
Let me close this since there already is a ticket for increasing netty to 4.1.
Our current plans are to get credit-based flow control through first
(FLINK-7282) and then try to increase the netty version and see what happens.
Regarding the issue with netty = 4.0.27, let me copy the comment in our root
{{pom.xml}}:
{quote}
Don't upgrade for now. Netty versions >=
4.0.28.Final
contain an improvement by Netty, which slices a
Netty buffer
instead of doing a memory copy [1] in the
LengthFieldBasedFrameDecoder. In some
situations, this
interacts badly with our Netty pipeline leading
to OutOfMemory
errors.
[1] https://github.com/netty/netty/issues/3704
{quote}
At the moment, we do not know whether this is still valid. I accidentally
changed the same thing that is/was causing the problem in
https://github.com/apache/flink/pull/4529 - if it still is a problem (I'll
investigate, eventually) then we know how to restore the old behaviour at
least. Let's see.
> Security Problems with Netty version 4.0.27.Final
> -------------------------------------------------
>
> Key: FLINK-8170
> URL: https://issues.apache.org/jira/browse/FLINK-8170
> Project: Flink
> Issue Type: Bug
> Components: Core
> Reporter: Jens Oberender
>
> I did an OWASP dependency check on my flink project and it reports two
> problems for netty version 4.0.27.Final:
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2156
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4970
> According to #FLINK-3151 there was a memory problem with newer versions.
> I couldn't find a reference to that problem in the netty issues. Perhaps it's
> already fixed with newer versions (netty 4.0.27 was release in Apr, 2015).
> Unfortunatelly I'm not that familiar with flink yet, to build a setup to
> reproduce the memory problem. Can anyone try it with a newer version of netty
> (4.0.53.Final is the latest of 4.0)?
> I came across an article about finding netty memory leaks with ByteBuf,
> perhaps that can help:
> https://logz.io/blog/netty-bytebuf-memory-leak/
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
