Azure / Azure/azure-sdk-for-java
[FEATURE REQ] Upgrade Netty dependencies in Cosmos SDK
- Dominant language
- Java
- Stars
- 2.6k
- Forks
- 2.2k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 178
Description
**Is your feature request related to a problem? Please describe.**
In direct mode, the current Netty version adopted by Cosmos SDK uses an Netty version does not verify endpoint. [Not doing hostname verification is obsolete and insecure practice](https://github.com/netty/netty/wiki/Netty-4.2-Migration-Guide).
Current Cosmos SDK API version does not offer ways to configure/validate the endpoint.
**Describe the solution you'd like**
I would vote that Cosmos SDK adopts a more recent and less vulnerable [Netty version](https://mvnrepository.com/artifact/com.azure/azure-core-http-netty/1.16.0). Ideally the latest 4.2.x
**Describe alternatives you've considered**
I considered upgrading the Netty dependencies myself but current Cosmos SDK code will not work without a patch.
Thanks!
Contributor guide
Assessment
This issue has not been assessed yet.