Update vulnerable netty version

ballerina/Ballerina.toml

@@ -1,7 +1,7 @@
 [package]
 org = "ballerina"
 name = "grpc"
-version = "1.8.0"
+version = "1.8.1"
 distribution = "2201.5.0"
 authors = ["Ballerina"]
 keywords = ["network", "grpc", "protobuf", "server-streaming", "client-streaming", "bidirectional-streaming"]
@@ -13,11 +13,11 @@ export = ["grpc", "grpc.types.duration", "grpc.types.struct", "grpc.types.timest
 [[platform.java11.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "grpc-native"
-version = "1.8.0"
-path = "../native/build/libs/grpc-native-1.8.0.jar"
+version = "1.8.1"
+path = "../native/build/libs/grpc-native-1.8.1-SNAPSHOT.jar"
 
 [[platform.java11.dependency]]
-path = "../test-utils/build/libs/grpc-test-utils-1.8.0.jar"
+path = "../test-utils/build/libs/grpc-test-utils-1.8.1-SNAPSHOT.jar"
 scope = "testOnly"
 
 [[platform.java11.dependency]]
@@ -31,68 +31,68 @@ scope = "testOnly"
 [[platform.java11.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "http-native"
-version = "2.8.0"
-path = "./lib/http-native-2.8.0.jar"
+version = "2.8.1"
+path = "./lib/http-native-2.8.1.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-common"
-version = "4.1.86.Final"
-path = "./lib/netty-common-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-common-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-buffer"
-version = "4.1.86.Final"
-path = "./lib/netty-buffer-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-buffer-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-transport"
-version = "4.1.86.Final"
-path = "./lib/netty-transport-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-transport-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-resolver"
-version = "4.1.86.Final"
-path = "./lib/netty-resolver-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-resolver-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-handler"
-version = "4.1.86.Final"
-path = "./lib/netty-handler-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-handler-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-codec-http"
-version = "4.1.86.Final"
-path = "./lib/netty-codec-http-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-codec-http-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-codec"
-version = "4.1.86.Final"
-path = "./lib/netty-codec-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-codec-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-handler-proxy"
-version = "4.1.86.Final"
-path = "./lib/netty-handler-proxy-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-handler-proxy-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-codec-http2"
-version = "4.1.86.Final"
-path = "./lib/netty-codec-http2-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-codec-http2-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-transport-native-unix-common"
-version = "4.1.86.Final"
-path = "./lib/netty-transport-native-unix-common-4.1.86.Final.jar"
+version = "4.1.94.Final"
+path = "./lib/netty-transport-native-unix-common-4.1.94.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "commons.pool.wso2"
@@ -115,29 +115,29 @@ path = "./lib/bcpkix-jdk15on-1.69.jar"
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-tcnative-classes"
-version = "2.0.54.Final"
-path = "./lib/netty-tcnative-classes-2.0.54.Final.jar"
+version = "2.0.61.Final"
+path = "./lib/netty-tcnative-classes-2.0.61.Final.jar"
 
 [[platform.java11.dependency]]
 groupId = "io.netty"
 artifactId = "netty-tcnative-boringssl-static"
-version = "2.0.54.Final"
-path = "./lib/netty-tcnative-boringssl-static-2.0.54.Final.jar"
+version = "2.0.61.Final"
+path = "./lib/netty-tcnative-boringssl-static-2.0.61.Final.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-tcnative-boringssl-static-2.0.54.Final-windows-x86_64.jar"
+path = "./lib/netty-tcnative-boringssl-static-2.0.61.Final-windows-x86_64.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-tcnative-boringssl-static-2.0.54.Final-linux-aarch_64.jar"
+path = "./lib/netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-tcnative-boringssl-static-2.0.54.Final-linux-x86_64.jar"
+path = "./lib/netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-tcnative-boringssl-static-2.0.54.Final-osx-aarch_64.jar"
+path = "./lib/netty-tcnative-boringssl-static-2.0.61.Final-osx-aarch_64.jar"
 
 [[platform.java11.dependency]]
-path = "./lib/netty-tcnative-boringssl-static-2.0.54.Final-osx-x86_64.jar"
+path = "./lib/netty-tcnative-boringssl-static-2.0.61.Final-osx-x86_64.jar"
 
 [[platform.java11.dependency]]
 groupId = "com.google.protobuf"

ballerina/CompilerPlugin.toml

@@ -3,4 +3,4 @@ id = "grpc-compiler-plugin"
 class = "io.ballerina.stdlib.grpc.plugin.GrpcCompilerPlugin"
 
 [[dependency]]
-path = "../compiler-plugin/build/libs/grpc-compiler-plugin-1.8.0.jar"
+path = "../compiler-plugin/build/libs/grpc-compiler-plugin-1.8.1-SNAPSHOT.jar"

ballerina/Dependencies.toml

@@ -68,7 +68,7 @@ dependencies = [
 [[package]]
 org = "ballerina"
 name = "grpc"
-version = "1.8.0"
+version = "1.8.1"
 dependencies = [
 	{org = "ballerina", name = "auth"},
 	{org = "ballerina", name = "crypto"},
@@ -94,7 +94,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "http"
-version = "2.8.0"
+version = "2.8.1"
 scope = "testOnly"
 dependencies = [
 	{org = "ballerina", name = "auth"},
@@ -287,7 +287,7 @@ dependencies = [
 [[package]]
 org = "ballerina"
 name = "os"
-version = "1.6.0"
+version = "1.6.1"
 scope = "testOnly"
 dependencies = [
 	{org = "ballerina", name = "io"},
@@ -315,7 +315,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "task"
-version = "2.3.2"
+version = "2.3.3"
 dependencies = [
 	{org = "ballerina", name = "jballerina.java"},
 	{org = "ballerina", name = "time"}
@@ -336,7 +336,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "time"
-version = "2.2.4"
+version = "2.2.5"
 dependencies = [
 	{org = "ballerina", name = "jballerina.java"}
 ]

changelog.md

@@ -6,6 +6,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- [Address CVE-2023-34462 netty Vulnerability](https://github.com/ballerina-platform/ballerina-standard-library/issues/4602)
+
 ## [1.6.0] - 2023-02-20
 ### Added
 - [Exit the application when panicking inside a service](https://github.com/ballerina-platform/ballerina-standard-library/issues/3604)

gradle.properties

@@ -1,6 +1,6 @@
 org.gradle.caching=true
 group=io.ballerina.stdlib
-version=1.8.0
+version=1.8.1-SNAPSHOT
 #dependency versions
 ballerinaLangVersion=2201.5.0
 ballerinaTomlParserVersion=1.2.2
@@ -10,8 +10,8 @@ slf4jVersion=1.7.30
 protoGoogleCommonsVersion=1.17.0
 protobufJavaVersion=3.20.3
 jknackHandlebarsVersion=4.0.6
-nettyVersion=4.1.86.Final
-nettyTcnativeVersion=2.0.54.Final
+nettyVersion=4.1.94.Final
+nettyTcnativeVersion=2.0.61.Final
 picocliVersion=4.0.1
 githubSpotbugsVersion=4.0.5
 githubJohnrengelmanShadowVersion=5.2.0
@@ -47,7 +47,7 @@ stdlibAuthVersion=2.8.0
 stdlibJwtVersion=2.8.0
 stdlibOAuth2Version=2.8.0
 
-stdlibHttpVersion=2.8.0
+stdlibHttpVersion=2.8.1
 
 # Ballerinax Observer
 observeVersion=1.0.7