commit 04d3bd9a002b0426daaabb15fcfdc273e4ebab02
author Lee Dongjin <dongjin@apache.org> Wed Mar 03 09:45:24 2021 +0530
committer Manikumar Reddy <manikumar.reddy@gmail.com> Wed Mar 03 09:56:47 2021 +0530
tree 132ed0203f6c9990fe2dc1e96e59c0ec8bd4d156
parent b5565430610e4ffc88068ca6482f30792bb70de6

KAFKA-12389: Upgrade of netty-codec due to CVE-2021-21290

This security vulnerability was found in netty-codec-http, but [caused by netty itself](https://github.com/netty/netty/commit/c735357bf29d07856ad171c6611a2e1a0e0000ec) and [fixed in 4.1.59.Final](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2). So, upgrade the netty version from 4.1.51.Final to 4.1.59.Final.

Author: Lee Dongjin <dongjin@apache.org>

Reviewers: Manikumar Reddy <manikumar.reddy@gmail.com>

Closes #10235 from dongjinleekr/feature/KAFKA-12389

(cherry picked from commit 4b3e3a9e86a8293282095d15709c1aa56c526ddf)
Signed-off-by: Manikumar Reddy <manikumar.reddy@gmail.com>

gradle/dependencies.gradle

diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index d1b1786..90daf55 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -97,7 +97,7 @@
   mavenArtifact: "3.6.3",
   metrics: "2.2.0",
   mockito: "3.3.3",
-  netty: "4.1.50.Final",
+  netty: "4.1.59.Final",
   owaspDepCheckPlugin: "5.3.2.1",
   powermock: "2.0.7",
   reflections: "0.9.12",