Dependency of netty has an vulnerability CVE-2023-44487 'rapid reset' for HTTP/2

[profTwinglings]

Describe the bug

I think that aws-sdk isnt vulnerable, since a simliar library, azure SDK isnt (using netty as client only):
Azure/azure-sdk-for-java#37198

but can you confirm this?

Expected Behavior

no cve

Current Behavior

CVE warning

Reproduction Steps

Run owasp-dependency check

Possible Solution

Upgrade netty to 4.1.100:
https://netty.io/news/2023/10/10/4-1-100-Final.html

Additional Information/Context

No response

AWS Java SDK version used

software.amazon.awssdk/bom/2.21.2

JDK version used

latest 17

Operating System and version

linux from scratch

[profTwinglings]

I saw that the latest 2.21.4 version uses netty 4.1.100 but I decided to let this issue be open for anyone who searches for the CVE.

[debora-ito]

We were tracking this in your other Github issue, because of this comment - #4584 (comment).

Java SDK version 2.21.4 includes the upgraded netty version 4.1.100. Will go ahead and close this.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.