[
https://issues.apache.org/jira/browse/HBASE-29126?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nihal Jain updated HBASE-29126:
-------------------------------
Description:
netty
[4.1.117.Final|https://mvnrepository.com/artifact/io.netty/netty-all/4.1.117.Final]
and below has [CVE-2025-24970|https://nvd.nist.gov/vuln/detail/CVE-2025-24970]
which is fixed in
[4.1.118.Final|https://mvnrepository.com/artifact/io.netty/netty-all/4.1.118.Final]
Impact: When a special crafted packet is received via SslHandler it doesn't
correctly handle validation of such a packet in all cases which can lead to a
native crash.
See advisory:
* [https://github.com/advisories/GHSA-4g8c-wm8x-jfhw]
* [https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw]
was: netty
[4.1.113.Final|https://mvnrepository.com/artifact/io.netty/netty-all/4.1.113.Final]
and below has [CVE-2024-47535
|https://nvd.nist.gov/vuln/detail/CVE-2024-47535]which is fixed in
[4.1.115.Final|https://mvnrepository.com/artifact/io.netty/netty-all/4.1.115.Final]
> Bump netty4 to 4.1.118.Final
> ----------------------------
>
> Key: HBASE-29126
> URL: https://issues.apache.org/jira/browse/HBASE-29126
> Project: HBase
> Issue Type: Task
> Components: dependencies
> Reporter: Nihal Jain
> Assignee: Nihal Jain
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.7.0, 3.0.0-beta-2, 2.6.2
>
>
> netty
> [4.1.117.Final|https://mvnrepository.com/artifact/io.netty/netty-all/4.1.117.Final]
> and below has
> [CVE-2025-24970|https://nvd.nist.gov/vuln/detail/CVE-2025-24970] which is
> fixed in
> [4.1.118.Final|https://mvnrepository.com/artifact/io.netty/netty-all/4.1.118.Final]
> Impact: When a special crafted packet is received via SslHandler it doesn't
> correctly handle validation of such a packet in all cases which can lead to a
> native crash.
>
> See advisory:
> * [https://github.com/advisories/GHSA-4g8c-wm8x-jfhw]
> * [https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
