Azure / Azure/azure-sdk-for-java

[FEATURE REQ] Upgrade Netty dependencies in Cosmos SDK

Open
#47,109 1 comment 2 reactions 1 assignee Claimed by @FabianMeiswinkel View on GitHub
Client Cosmos customer-reported feature-request needs-team-attention Service Attention
Dominant language
Java
Stars
2.6k
Forks
2.2k
Avg merge
2d 8h
Merged PRs (30d)
178

Description

**Is your feature request related to a problem? Please describe.**

In direct mode, the current Netty version adopted by Cosmos SDK uses an Netty version does not verify endpoint. [Not doing hostname verification is obsolete and insecure practice](https://github.com/netty/netty/wiki/Netty-4.2-Migration-Guide).

Current Cosmos SDK API version does not offer ways to configure/validate the endpoint.

**Describe the solution you'd like**

I would vote that Cosmos SDK adopts a more recent and less vulnerable [Netty version](https://mvnrepository.com/artifact/com.azure/azure-core-http-netty/1.16.0). Ideally the latest 4.2.x

**Describe alternatives you've considered**

I considered upgrading the Netty dependencies myself but current Cosmos SDK code will not work without a patch.

Thanks!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.