Skip to content

Commit f02ea8b

Browse files
jorgeejorgee
committed
fix netty vulnerabilities
Signed-off-by: jorgee <jorge.ejarque@seqera.io>
1 parent d30e48d commit f02ea8b

4 files changed

Lines changed: 41 additions & 11 deletions

File tree

‎plugins/nf-amazon/build.gradle‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,18 @@ configurations {
5151
}
5252

5353
dependencies {
54+
// Force patched Netty across all configurations (incl. testRuntimeClasspath, where
55+
// a transitive fixture would otherwise escalate to 4.2.x).
56+
// Addresses GHSA-pwqr-wmgm-9rr8 (netty-codec-http HTTP Request Smuggling)
57+
// and GHSA-w9fj-cfpg-grvv (netty-codec-http2 CONTINUATION Frame Flood DoS).
58+
constraints {
59+
implementation('io.netty:netty-buffer') { version { strictly '4.1.132.Final' } }
60+
implementation('io.netty:netty-common') { version { strictly '4.1.132.Final' } }
61+
implementation('io.netty:netty-handler') { version { strictly '4.1.132.Final' } }
62+
implementation('io.netty:netty-codec-http') { version { strictly '4.1.132.Final' } }
63+
implementation('io.netty:netty-codec-http2') { version { strictly '4.1.132.Final' } }
64+
}
65+
5466
compileOnly project(':nextflow')
5567
compileOnly 'org.slf4j:slf4j-api:2.0.17'
5668
compileOnly 'org.pf4j:pf4j:3.14.1'
@@ -71,11 +83,6 @@ dependencies {
7183
api ('software.amazon.awssdk:apache-client:2.33.2')
7284
api ('software.amazon.awssdk:aws-crt-client:2.33.2')
7385

74-
// address security vulnerabilities
75-
implementation 'io.netty:netty-common:4.1.132.Final'
76-
implementation 'io.netty:netty-handler:4.1.132.Final'
77-
implementation 'io.netty:netty-codec-http2:4.1.132.Final'
78-
7986
testImplementation(testFixtures(project(":nextflow")))
8087
testImplementation project(':nextflow')
8188
testImplementation "org.apache.groovy:groovy:4.0.31"

‎plugins/nf-azure/build.gradle‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,17 +50,31 @@ configurations {
5050
}
5151

5252
dependencies {
53+
// Force patched Netty across all configurations (incl. testRuntimeClasspath, where
54+
// a transitive fixture would otherwise escalate to 4.2.x).
55+
// Addresses GHSA-pwqr-wmgm-9rr8 (netty-codec-http HTTP Request Smuggling)
56+
// and GHSA-w9fj-cfpg-grvv (netty-codec-http2 CONTINUATION Frame Flood DoS).
57+
// netty-buffer must be pinned alongside the rest -- leaving it at 4.2.x
58+
// (via Micronaut BOM) causes ABI mismatch in AbstractByteBufAllocator.
59+
constraints {
60+
implementation('io.netty:netty-buffer') { version { strictly '4.1.132.Final' } }
61+
implementation('io.netty:netty-common') { version { strictly '4.1.132.Final' } }
62+
implementation('io.netty:netty-handler') { version { strictly '4.1.132.Final' } }
63+
implementation('io.netty:netty-codec-http') { version { strictly '4.1.132.Final' } }
64+
implementation('io.netty:netty-codec-http2') { version { strictly '4.1.132.Final' } }
65+
}
66+
5367
compileOnly project(':nextflow')
5468
compileOnly 'org.slf4j:slf4j-api:2.0.17'
5569
compileOnly 'org.pf4j:pf4j:3.14.1'
56-
api('com.azure:azure-storage-blob:12.33.2') {
70+
api('com.azure:azure-storage-blob:12.33.3') {
5771
exclude group: 'org.slf4j', module: 'slf4j-api'
5872
}
5973
api('com.azure:azure-compute-batch:1.0.0-beta.3') {
6074
exclude group: 'org.slf4j', module: 'slf4j-api'
6175
exclude group: 'com.google.guava', module: 'guava'
6276
}
63-
api('com.azure:azure-identity:1.18.2') {
77+
api('com.azure:azure-identity:1.18.3') {
6478
exclude group: 'org.slf4j', module: 'slf4j-api'
6579
}
6680

‎plugins/nf-codecommit/build.gradle‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,18 @@ configurations {
4646
}
4747

4848
dependencies {
49+
// Force patched Netty across all configurations (incl. testRuntimeClasspath, where
50+
// a transitive fixture would otherwise escalate to 4.2.x).
51+
// Addresses GHSA-pwqr-wmgm-9rr8 (netty-codec-http HTTP Request Smuggling)
52+
// and GHSA-w9fj-cfpg-grvv (netty-codec-http2 CONTINUATION Frame Flood DoS).
53+
constraints {
54+
implementation('io.netty:netty-buffer') { version { strictly '4.1.132.Final' } }
55+
implementation('io.netty:netty-common') { version { strictly '4.1.132.Final' } }
56+
implementation('io.netty:netty-handler') { version { strictly '4.1.132.Final' } }
57+
implementation('io.netty:netty-codec-http') { version { strictly '4.1.132.Final' } }
58+
implementation('io.netty:netty-codec-http2') { version { strictly '4.1.132.Final' } }
59+
}
60+
4961
compileOnly project(':nextflow')
5062
compileOnly 'org.slf4j:slf4j-api:2.0.17'
5163
compileOnly 'org.pf4j:pf4j:3.14.1'
@@ -55,9 +67,6 @@ dependencies {
5567
api ('software.amazon.awssdk:sso:2.31.64')
5668
api ('software.amazon.awssdk:ssooidc:2.31.64')
5769

58-
// address security vulnerabilities
59-
runtimeOnly 'io.netty:netty-codec-http:4.1.132.Final'
60-
6170
testImplementation(testFixtures(project(":nextflow")))
6271
testImplementation project(':nextflow')
6372
testImplementation "org.apache.groovy:groovy:4.0.31"

‎plugins/nf-tower/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ dependencies {
6969
testImplementation "org.apache.groovy:groovy-nio:4.0.31"
7070
testImplementation "org.apache.groovy:groovy-json:4.0.31"
7171
// wiremock required by TowerFusionEnvTest
72-
testImplementation "org.wiremock:wiremock:3.13.1"
72+
testImplementation "org.wiremock:wiremock:3.13.2"
7373
// Address security vulnerabilities CVE-2022-45688 and CVE-2023-5072
7474
testImplementation 'org.json:json:20240303'
7575
}

0 commit comments

Comments
 (0)
⚡