[DNR] Upgraded version : io.netty:netty-common:4.1.115.Final

[imsayari404]

Description

2 Medium cve got resolved

Motivation and Context

About CVE-2024-47535

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

Impact

2 Medium cve got resolved.

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes
* Fix security vulnerability in  io.netty:netty-common:jar:4.1.115.Final jar in response to 'CVE-2024-47535 <https://www.mend.io/vulnerability-database/CVE-2024-47535>' :pr:`#24175`

[agrawalreetika]

I see most of the drift dependencies are at 4.1.107.Final which is getting set from https://github.com/prestodb/drift/blob/master/pom.xml

I think it would be better to handle these dependencies version from shaded jar? It would help resolving CVEs for all the related dependency instead of handling it here for each artifect.

[imsayari404]

I see most of the drift dependencies are at 4.1.107.Final which is getting set from https://github.com/prestodb/drift/blob/master/pom.xml

I think it would be better to handle these dependencies version from shaded jar? It would help resolving CVEs for all the related dependency instead of handling it here for each artifect.

Thanks for the suggestion @agrawalreetika , I noticed that most of the Drift dependencies are set to 4.1.107.Final as per the Drift pom.xml. I agree that managing versions through a shaded JAR is a good approach for better dependency management, particularly for resolving CVEs and preventing version conflicts. I'll proceed with the changes as you suggested.

[agrawalreetika]

@tdcmeehan What are your thoughts around this, resolving drift related cves directly in the shaded jar?

[tdcmeehan]

Can you help me understand how a shaded JAR will help? Why not just update the version within Drift without shading?

[agrawalreetika]

Can you help me understand how a shaded JAR will help? Why not just update the version within Drift without shading?

I am sorry, my mistake. I mean updating the drift dependency in drift repo and updating its version in presto pom. Instead of directly updating those drift dependency in Presto directly.
Sorry about the confusion.

[tdcmeehan]

Oh, then agreed--let's fix it in Drift first.