CVE-2019-20444 io.netty:netty-tcnative-classes:jar:2.0.48.Final:compile (version managed from 2.0.48.Final)

[hakky54]

CVE-2019-20444 io.netty:netty-tcnative-classes:jar:2.0.48.Final:compile (version managed from 2.0.48.Final)

[patpatpat123]

Hello @Hakky54,

Explicitly managing the version indeed solves the problem.
Thanks a lot!

[Hakky54]

Hi Patrick,

Long time no see! I am doing great, how are you doing?

The dependency on netty-tcnative-classes should not be included by this library as netty-handler is defined as a provided dependency. So it is not available by my library at compile time. See here for the location where it is defined:

sslcontext-kickstart/sslcontext-kickstart-for-netty/pom.xml

Line 98 in bd593b3

<scope>provided</scope>

I did a check with one of my project which is using sslcontext-kickstart-for-netty gRPC Server with Netty and SSL enabled and run mvn dependency:tree on it. See below for the results:

[INFO] -------------------< io.github.hakky54:grpc-server >--------------------
[INFO] Building grpc-server 1.0.0-SNAPSHOT                              [15/24]
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ grpc-server ---
[INFO] io.github.hakky54:grpc-server:jar:1.0.0-SNAPSHOT
[INFO] +- io.grpc:grpc-netty:jar:1.44.1:compile
[INFO] |  +- io.grpc:grpc-core:jar:1.44.1:compile (version selected from constraint [1.44.1,1.44.1])
[INFO] |  |  +- io.grpc:grpc-api:jar:1.44.1:compile (version selected from constraint [1.44.1,1.44.1])
[INFO] |  |  |  \- io.grpc:grpc-context:jar:1.44.1:compile
[INFO] |  |  +- com.google.code.gson:gson:jar:2.8.9:runtime
[INFO] |  |  +- com.google.android:annotations:jar:4.1.1.4:runtime
[INFO] |  |  \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.19:runtime
[INFO] |  +- io.netty:netty-codec-http2:jar:4.1.72.Final:compile
[INFO] |  |  +- io.netty:netty-common:jar:4.1.72.Final:compile
[INFO] |  |  +- io.netty:netty-buffer:jar:4.1.72.Final:compile
[INFO] |  |  +- io.netty:netty-transport:jar:4.1.72.Final:compile
[INFO] |  |  |  \- io.netty:netty-resolver:jar:4.1.72.Final:compile
[INFO] |  |  +- io.netty:netty-codec:jar:4.1.72.Final:compile
[INFO] |  |  +- io.netty:netty-handler:jar:4.1.72.Final:compile
[INFO] |  |  |  \- io.netty:netty-tcnative-classes:jar:2.0.46.Final:compile
[INFO] |  |  \- io.netty:netty-codec-http:jar:4.1.72.Final:compile
[INFO] |  +- io.netty:netty-handler-proxy:jar:4.1.72.Final:runtime
[INFO] |  |  \- io.netty:netty-codec-socks:jar:4.1.72.Final:runtime
[INFO] |  +- com.google.guava:guava:jar:30.1.1-android:compile
[INFO] |  |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO] |  |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] |  |  +- org.checkerframework:checker-compat-qual:jar:2.5.5:compile
[INFO] |  |  \- com.google.j2objc:j2objc-annotations:jar:1.3:compile
[INFO] |  +- com.google.errorprone:error_prone_annotations:jar:2.9.0:compile
[INFO] |  \- io.perfmark:perfmark-api:jar:0.23.0:runtime
[INFO] +- io.github.hakky54:common-proto:jar:1.0.0-SNAPSHOT:compile
[INFO] |  +- com.google.protobuf:protobuf-java:jar:3.19.4:compile
[INFO] |  +- io.grpc:grpc-protobuf:jar:1.44.1:compile
[INFO] |  |  +- com.google.api.grpc:proto-google-common-protos:jar:2.0.1:compile
[INFO] |  |  \- io.grpc:grpc-protobuf-lite:jar:1.44.1:compile
[INFO] |  +- io.grpc:grpc-stub:jar:1.44.1:compile
[INFO] |  \- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] +- io.github.hakky54:sslcontext-kickstart-for-netty:jar:7.3.0:compile
[INFO] |  \- io.github.hakky54:sslcontext-kickstart:jar:7.3.0:compile
[INFO] \- org.slf4j:slf4j-simple:jar:1.7.36:compile
[INFO]    \- org.slf4j:slf4j-api:jar:1.7.36:compile

As you can see in this dependency tree sslcontext-kickstart-for-netty does not have any netty dependencies at compile time and runtime for the end-user/library user. So I find it strange that you are having a different output, but maybe your project is configured different?

Can you try the snippet below and share your results?

<dependencies>
    <dependency>
        <groupId>io.netty</groupId>
        <artifactId>netty-handler</artifactId>
    </dependency>
    <dependency>
        <groupId>io.github.hakky54</groupId>
        <artifactId>sslcontext-kickstart-for-netty</artifactId>
    </dependency>
</dependencies>

<dependencyManagement>
    <dependencies>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler</artifactId>
                <version>4.1.75.Final</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-tcnative-classes</artifactId>
                <version>2.0.51.Final</version>
            </dependency>
            <dependency>
                <groupId>io.github.hakky54</groupId>
                <artifactId>sslcontext-kickstart-for-netty</artifactId>
                <version>7.3.0</version>
            </dependency>
    </dependencies>
</dependencyManagement>

[Hakky54]

Hi Patrick @patpatpat123

Did you get a chance to try my suggestion? Looking forward to hear from you.