Mailing-List: contact user-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@zookeeper.apache.org
MIME-Version: 1.0
In-Reply-To: <CANLc_9J4OhvJCkwod9waWo4iDRO7fx6Wm-gpCXKzmCNsh_ee7g@mail.gmail.com>
References: <D37B2D4A.38D2%pallavi_hegde@bmc.com>
	<CA+i0x1LtR89Uf7qCpZvdZ04K_LbBfadKSFjhp5KBwW_YTZSL5g@mail.gmail.com>
	<CANLc_9J4OhvJCkwod9waWo4iDRO7fx6Wm-gpCXKzmCNsh_ee7g@mail.gmail.com>
Date: Wed, 8 Jun 2016 08:31:32 -0700
Message-ID: <CAMUR=WiAKg+LMvkORn1cWSxYZ3yRDxy6Ur49gumKdfMV8+neyQ@mail.gmail.com>
Subject: Re: Zookeeper 3.4.8 is bundled with old version of Netty:jar
From: =?UTF-8?B?UmHDumwgR3V0acOpcnJleiBTZWdhbMOpcw==?= <rgs@itevenworks.net>
To: "dev@zookeeper.apache.org" <dev@zookeeper.apache.org>
Cc: UserZooKeeper <user@zookeeper.apache.org>
Content-Type: multipart/alternative; boundary=001a1134f96a09894b0534c60035
archived-at: Wed, 08 Jun 2016 15:31:41 -0000

--001a1134f96a09894b0534c60035
Content-Type: text/plain; charset=UTF-8

On 7 June 2016 at 18:48, Patrick Hunt <phunt@apache.org> wrote:

> There is a jira for this already. Someone want to drive this one?
>
> https://issues.apache.org/jira/browse/ZOOKEEPER-2399


So are we good in the 3.4 branch after:

https://github.com/apache/zookeeper/commit/f0a49567d545bd6584cb8ece2d491dc6c65174f8

or would we still need to backup netty 4.x support to that branch
(eventually)?


-rgs


>
>
> Patrick
>
> On Mon, Jun 6, 2016 at 1:51 PM, Michael Han <hanm@cloudera.com> wrote:
>
> > FYI branch 3.4 was recently patched with Netty 3.10 to address some of
> the
> > security concerns as described in ZOOKEEPER-2423: Upgrade Netty version
> due
> > to security vulnerability.
> >
> >
> >
> https://github.com/apache/zookeeper/commit/f0a49567d545bd6584cb8ece2d491dc6c65174f8
> >
> >
> >
> >
> > On Mon, Jun 6, 2016 at 1:38 PM, Hegde, Pallavi <pallavi_hegde@bmc.com>
> > wrote:
> >
> > > Hello,
> > > We are currently facing some security issues with Zookeeper version
> 3.4.7
> > > & 3.4.8, since its bundled with very old version of Netty:jar, version
> > > 3.7.0.
> > > Could you address this issue in future Zookeeper releases by packaging
> it
> > > with Netty.jar-4.0.27, or higher version of Netty:jar? I am sure this
> > will
> > > help many other issues including security violations.
> > >
> > > Thanks
> > > Pallavi
> > >
> > >
> >
> >
> > --
> > Cheers
> > Michael.
> >
>

--001a1134f96a09894b0534c60035--