playframework
High Severity Security Vulnerability: sonatype-2021-0789
shaded-asynchttpclient-2.2.9.jarplay/shaded/ahc/io/netty/handler/codec/compression/Lz4FrameEncoder.class[4.1.0.Beta2 , 4.1.66.Final) has a high vulnerability related to buffer overflow.
The root cause is an out of date netty transitive dependency. Please upgrade the netty-codec version to one that is not vulnerable
This issue was addressed in netty by: https://github.com/netty/netty/pull/11429
Probably the best thing to do anyway is to backport #866 to the current stable branches. Making sure the shaded libraries are up-to-date is a very good idea in general anyway IMHO. I do not expect anything breaking for play-ws 🤞.
Created https://github.com/playframework/playframework/issues/12893 to not forget about this, will be done soon with next Play patch release.
Fixed in latest releases:
- https://github.com/playframework/play-ws/releases/tag/2.2.10
- https://github.com/playframework/play-ws/releases/tag/3.0.6
Will be part of next Play 3.0.6 and 2.9.6:
- https://github.com/playframework/playframework/pull/12973
- https://github.com/playframework/playframework/pull/12974