Vulnerability CVE-2023-4586 was found in sts-2.21.5.jar

[wang-wayne]

Describe the bug

CVE-2023-4586 was found in netty-handler-4.1.100.Final.jar which is used in sts-2.21.5.jar

Suggested Fix
Upgrade to version: io.netty:netty-handler - 5.0.0.Alpha1

Expected Behavior

Remediate the vulnerability.

Current Behavior

CVE-2023-4586

Reproduction Steps

Dependency Hierarchy:

• sts-2.21.5.jar (Root Library)
  • netty-nio-client-2.21.5.jar
    • ❌ netty-handler-4.1.100.Final.jar (Vulnerable Library)

Possible Solution

No response

Additional Information/Context

No response

AWS Java SDK version used

2.21.5

JDK version used

12.0.1

Operating System and version

Mac

[Morl99]

Chiming in with a little more context: Upstream Issue in Netty
It is explained there on how to configure Netty, in order to mitigate this.

Updating to the alpha1 as recommended by Mend is a joke, I hope ;)

[debora-ito]

Duplicate, see #4584 (comment). We are not impacted.

Searching for "CVE-2023-4586" in this repo you'll find that this was reported already.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.