[RORDEV-1394] CVE-2024-57699 CVE-2025-25193 CVE-2025-24970 #1075
Conversation
📝 WalkthroughWalkthroughThe changes update dependency versions and properties in various Gradle configuration files. In the 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (10)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
core/build.gradle(1 hunks)gradle.properties(1 hunks)ror-shadowed-libs/build.gradle(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- gradle.properties
⏰ Context from checks skipped due to timeout of 90000ms (10)
- GitHub Check: ror (Run all tests IT_es67x)
- GitHub Check: ror (Run all tests IT_es70x)
- GitHub Check: ror (Run all tests IT_es710x)
- GitHub Check: ror (CVE check Job)
- GitHub Check: ror (Run all tests IT_es717x)
- GitHub Check: ror (Run all tests IT_es80x)
- GitHub Check: ror (Run all tests UNIT)
- GitHub Check: ror (Run all tests IT_es810x)
- GitHub Check: ror (Run all tests LICENSE)
- GitHub Check: ror (Run all tests IT_es816x)
🔇 Additional comments (1)
core/build.gradle (1)
128-132: LGTM! Security update for Netty dependencies.The update to Netty 4.1.118.Final appears to address security vulnerabilities. Let's verify if this version resolves the mentioned CVEs.
✅ Verification successful
🌐 Web query:
Does Netty version 4.1.118.Final address CVE-2024-57699, CVE-2025-25193, or CVE-2025-24970?💡 Result:
Netty version 4.1.118.Final addresses CVE-2025-24970 and CVE-2025-25193, but does not resolve CVE-2024-57699. Here's the breakdown:
Addressed Vulnerabilities
1. CVE-2025-24970
A critical vulnerability inio.netty:netty-handlercaused by improper SSL packet validation when using native SSLEngine, leading to native crashes[2][4][6][10].
Fix: Patched in Netty 4.1.118.Final[6][9][10].2. CVE-2025-25193
A Denial of Service (DoS) vulnerability affecting Windows applications using Netty[4].
Fix: Resolved in Netty 4.1.118.Final[4].Unrelated Vulnerability
CVE-2024-57699
This vulnerability pertains to Netplex Json-smart 2.x, not Netty[1][5]. It appears in Spring Boot dependencies lists but is unrelated to Netty’s codebase[1].
To mitigate these issues:
<dependency> <groupId>io.netty</groupId> <artifactId>netty-handler</artifactId> <version>4.1.118.Final</version> </dependency>For non-Maven projects, ensure
netty-handler >= 4.1.118.Final[9][10].Citations:
- 1: https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-dependencies/3.3.1
- 2: https://vulert.com/vuln-db/CVE-2025-24970
- 3: https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-parent/3.2.3
- 4: https://netty.io/news/2025/02/10/4-1-118-Final.html
- 5: https://www.mail-archive.com/search?l=debian-security-tracker-commits%40alioth-lists.debian.net&q=from%3A%22Salvatore+Bonaccorso+%5C%28%40carnil%5C%29%22&o=newest&f=1
- 6: https://osv.dev/vulnerability/CVE-2025-24970
- 7: https://milaosterhaus.nl/cve.html
- 8: https://avd.aquasec.com/nvd/2025/cve-2025-24970/
- 9: https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-8707739
- 10: GHSA-4g8c-wm8x-jfhw
Security Update Verification for Netty Dependencies
- Netty 4.1.118.Final resolves CVE-2025-24970 and CVE-2025-25193.
- CVE-2024-57699 is not applicable to Netty (it's related to Netplex Json-smart).
🚨Security Fix (ES) CVE-2024-57699 CVE-2025-25193 CVE-2025-24970
Summary by CodeRabbit