From 8163b2509512b07ef560019a3a7948a7dbf7ef36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Pupier?= <apupier@redhat.com>
Date: Tue, 17 Oct 2023 14:48:44 +0200
Subject: [PATCH] Upgrade and Pin Netty 4.1.100.Final
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- it is a dependency of Zookeeper
- Netty 4.1.100.Final contains a fix for important CVE
- Citrus is then affected but given the context of usage of Citrus with
good chance of not being vulnerable
- Zookeeper has not integrated the fixed version yet
- Pinning here will avoid having Citrus to be flagged and ease
integration for consumers of Citrus

Signed-off-by: Aurélien Pupier <apupier@redhat.com>
---
 endpoints/citrus-zookeeper/pom.xml |  9 +++++++++
 pom.xml                            | 12 ++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/endpoints/citrus-zookeeper/pom.xml b/endpoints/citrus-zookeeper/pom.xml
index 14fa18982b..b24c991453 100644
--- a/endpoints/citrus-zookeeper/pom.xml
+++ b/endpoints/citrus-zookeeper/pom.xml
@@ -62,6 +62,15 @@
       <groupId>org.apache.zookeeper</groupId>
       <artifactId>zookeeper</artifactId>
     </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-handler</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>io.netty</groupId>
+      <artifactId>netty-transport-native-epoll</artifactId>
+      <classifier>linux-x86_64</classifier>
+    </dependency>
     <dependency>
       <groupId>io.dropwizard.metrics</groupId>
       <artifactId>metrics-core</artifactId>
diff --git a/pom.xml b/pom.xml
index 2a943e6b00..8d3380f496 100644
--- a/pom.xml
+++ b/pom.xml
@@ -223,6 +223,7 @@
     <log4j2.version>2.20.0</log4j2.version>
     <mockito.version>5.6.0</mockito.version>
     <mockftpserver.version>3.1.0</mockftpserver.version>
+    <netty.version>4.1.100.Final</netty.version>
     <okhttp.version>4.11.0</okhttp.version>
     <saaj.version>3.0.2</saaj.version>
     <selenium.version>4.13.0</selenium.version>
@@ -986,6 +987,17 @@
         <version>${jakarta.validation.version}</version>
       </dependency>
 
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-handler</artifactId>
+        <version>${netty.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-transport-native-epoll</artifactId>
+        <classifier>linux-x86_64</classifier>
+        <version>${netty.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.apache.zookeeper</groupId>
         <artifactId>zookeeper</artifactId>