Netty Vulnerability in Neo4j Java Driver

[hgueltig]

Hi,

there is an open Vulnerability in the Netty dependency of the current Neo4j Java Driver which is already fixed in newer Netty versions.

An issue in the GitHub project has already been opened by someone:

github.com/neo4j/neo4j-java-driver

Vulnerability in the dependency netty-codec

opened 07:21AM - 19 Jan 22 UTC

Re-Jacky

Hi, the latest `4.4.2` driver contains the `netty-codec` package with version `4….1.70.Final`, which have known vulnerability described here: https://nvd.nist.gov/vuln/detail/CVE-2021-43797 Do you have any plan to get it updated? Thanks.

Other Netty dependencies like netty-transport, netty-buffer and so on are affected too.

We are also waiting for this vulnerability to be closed, is there a timeline when this dependency will be updated?

Thanks

[t_gertler]

Hi,

I'm also waiting for this. I would be nice to have a timeline information.

Cheers,
Thomas

[dmitriy_tverdia · Accepted solution]

Hi. We will aim to get a new version released by the end of the week.

[dmitriy_tverdia]

New version: https://community.neo4j.com/t/neo4j-driver-for-java-releases/2219/51