Uploaded image for project: 'JBeret'
  1. JBeret
  2. JBERET-457

Upgrade io.vertx:vertx-core to version 3.5.4 or later to address vulnerability

    Details

      Description

      https://github.com/jberet/jsr352/network/alert/pom.xml/io.vertx:vertx-core/open

      CVE-2018-12541
      low severity
      Vulnerable versions: >= 3.0.0, < 3.5.4
      Patched version: 3.5.4
      In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.

      The latest version of vertx-core at maven central:

      <dependency>
        <groupId>io.vertx</groupId>
        <artifactId>vertx-core</artifactId>
        <version>3.6.0</version>
      </dependency>
      

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                cfang Cheng Fang
                Reporter:
                cfang Cheng Fang
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: