What is the right way to upgrade netty and its components for security reason?

user_188185 0
Viewed 5191

Our spring boot (cloud) application uses rx-netty, whose version is 0.4.20. And it sets netty and its components to version 4.1.5.Final.

Currently our security auditing system found that the current netty-codec version (4.1.52.Final) is vulnerable and suggested us to upgrade to version 4.1.68+.

I tried to lock netty-codec in pom.xml to 4.1.68.Final, but then I found that other netty components like netty-buffer or netty-handler still stay at 4.1.52.

I want to know:

  • Should I keep all the netty components at the same version?
  • What is the right way to upgrade individual vulnerable components?

Thanks

Update:

mvn dependency:tree

...
[INFO] +- io.reactivex:rxnetty-contexts:jar:0.4.20:compile
[INFO] +- io.reactivex:rxnetty-servo:jar:0.4.20:compile
[INFO] |  \- com.netflix.servo:servo-core:jar:0.12.21:runtime
[INFO] +- io.reactivex:rxnetty:jar:0.4.20:compile
[INFO] |  +- io.netty:netty-codec-http:jar:4.1.69.Final:runtime
[INFO] |  |  +- io.netty:netty-common:jar:4.1.69.Final:runtime
[INFO] |  |  +- io.netty:netty-buffer:jar:4.1.52.Final:runtime
[INFO] |  |  +- io.netty:netty-transport:jar:4.1.52.Final:runtime
[INFO] |  |  \- io.netty:netty-codec:jar:4.1.52.Final:runtime
[INFO] |  +- io.netty:netty-handler:jar:4.1.69.Final:runtime
[INFO] |  |  \- io.netty:netty-resolver:jar:4.1.52.Final:runtime
[INFO] |  +- io.netty:netty-transport-native-epoll:jar:4.1.69.Final:runtime
[INFO] |  |  \- io.netty:netty-transport-native-unix-common:jar:4.1.52.Final:runtime
...
rx-netty spring-boot security
1 Answers

Note that: Spring boot version 2.5.5 uses netty 4.1.68.Final, so you should be OK if you upgrade spring-boot-starter-parent to 2.5.5

That being said:

How I upgrade to a higher/lower version of a dependency in spring-boot:

  • have a look at the properties configured in spring-boot-dependencies
  • change that property in my pom.xml with the wanted version

In your case, add netty.version:4.1.69.Final to your properties:

    <properties>
        <java.version>11</java.version>
        <netty.version>4.1.69.Final</netty.version>
        
    </properties>

UPDATE:

When using <netty.version>4.1.69.Final</netty.version> with spring-boot-starter-parent:2.2.10.RELEASE, ref Gist netty-upgrade

when you execute mvn dependency:tree you can see that every netty dependency is upgraded to 4.1.69.Final

output filtered on 'netty'

    Regel 1: [INFO] --- maven-dependency-plugin:3.1.2:tree (default-cli) @ netty-upgrade ---
    Regel 2: [INFO] com.example:netty-upgrade:jar:0.0.1-SNAPSHOT
    Regel 25: [INFO] |  +- org.springframework.boot:spring-boot-starter-reactor-netty:jar:2.2.10.RELEASE:compile
    Regel 26: [INFO] |  |  +- io.projectreactor.netty:reactor-netty:jar:0.9.12.RELEASE:compile
    Regel 26: [INFO] |  |  +- io.projectreactor.netty:reactor-netty:jar:0.9.12.RELEASE:compile
    Regel 27: [INFO] |  |  |  +- io.netty:netty-codec-http2:jar:4.1.69.Final:compile
    Regel 27: [INFO] |  |  |  +- io.netty:netty-codec-http2:jar:4.1.69.Final:compile
    Regel 28: [INFO] |  |  |  +- io.netty:netty-handler-proxy:jar:4.1.69.Final:compile
    Regel 28: [INFO] |  |  |  +- io.netty:netty-handler-proxy:jar:4.1.69.Final:compile
    Regel 29: [INFO] |  |  |  |  \- io.netty:netty-codec-socks:jar:4.1.69.Final:compile
    Regel 29: [INFO] |  |  |  |  \- io.netty:netty-codec-socks:jar:4.1.69.Final:compile
    Regel 30: [INFO] |  |  |  \- io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.69.Final:compile
    Regel 30: [INFO] |  |  |  \- io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.69.Final:compile
    Regel 42: [INFO] +- io.reactivex:rxnetty:jar:0.5.1:runtime
    Regel 44: [INFO] |  +- io.netty:netty-codec-http:jar:4.1.69.Final:compile
    Regel 44: [INFO] |  +- io.netty:netty-codec-http:jar:4.1.69.Final:compile
    Regel 45: [INFO] |  |  +- io.netty:netty-common:jar:4.1.69.Final:compile
    Regel 45: [INFO] |  |  +- io.netty:netty-common:jar:4.1.69.Final:compile
    Regel 46: [INFO] |  |  +- io.netty:netty-buffer:jar:4.1.69.Final:compile
    Regel 46: [INFO] |  |  +- io.netty:netty-buffer:jar:4.1.69.Final:compile
    Regel 47: [INFO] |  |  +- io.netty:netty-transport:jar:4.1.69.Final:compile
    Regel 47: [INFO] |  |  +- io.netty:netty-transport:jar:4.1.69.Final:compile
    Regel 48: [INFO] |  |  \- io.netty:netty-codec:jar:4.1.69.Final:compile
    Regel 48: [INFO] |  |  \- io.netty:netty-codec:jar:4.1.69.Final:compile
    Regel 49: [INFO] |  +- io.netty:netty-handler:jar:4.1.69.Final:compile
    Regel 49: [INFO] |  +- io.netty:netty-handler:jar:4.1.69.Final:compile
    Regel 50: [INFO] |  |  \- io.netty:netty-resolver:jar:4.1.69.Final:compile
    Regel 50: [INFO] |  |  \- io.netty:netty-resolver:jar:4.1.69.Final:compile
    Regel 51: [INFO] |  +- io.netty:netty-transport-native-epoll:jar:4.1.69.Final:runtime
    Regel 51: [INFO] |  +- io.netty:netty-transport-native-epoll:jar:4.1.69.Final:runtime
    Regel 52: [INFO] |  |  \- io.netty:netty-transport-native-unix-common:jar:4.1.69.Final:compile
    Regel 52: [INFO] |  |  \- io.netty:netty-transport-native-unix-common:jar:4.1.69.Final:compile

So, if you still have references to an other version, use mvn dependency:tree to see where that reference comes from.

user_96817550
Related