AWS Inspector reports HIGH finding with SNYK-JAVA-IONETTY-5725787

[adisnuhan]

Dear comunity,

since couple of months AWS reports MEDIUM level security finding related to io.netty:netty-handler and comming packed together with quarkus (currently using 2.16.6.Final). We kind of ignored it for long period as it was MEDIUM level. But since yesterday this finding was reported as HIGH and now is the time to tackle it. I was searching in internet if there are some quarkus related questions or posts, but I was not able to find it. Can someone help me with this finding (https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-5725787)?

There are also other findings like:

1. GHSA-6mjq-h674-j845
2. https://nvd.nist.gov/vuln/detail/CVE-2023-24815
3. https://access.redhat.com/security/cve/CVE-2022-3715

Also wanted to ask, if there is an official quarkus page where quarkus team is reacting on such security findings?

Thanks in advance!

Regards,
Adis

[sberyozkin]

@adisnuhan It will be addressed by #34249, thanks

[adisnuhan]

Hi @sberyozkin , will this fix only be part of quarkus 3.x or will also be integrated into 2.x version?

[sberyozkin]

@adisnuhan I see Guillaume confirmed it in #34249

[maxandersen]

https://quarkus.io/security