search

Red5 / red5-client

Red5 Client
Apache License 2.0
162 stars 140 forks source link

Red5-client is dependent on vulnerable version of mina-core #52

Open rawler opened 2 years ago

rawler commented 2 years ago

Details can be seen on https://mvnrepository.com/artifact/org.red5/red5-client/1.2.12

Tried to patch it up myself, but failed to understand what controls ${mina.version} in pom.xml.

mondain commented 2 years ago

@rawler the versions will normally be found in the properties section of the current pom or in the parent pom (see red5-parent). Also the CVE linked does not affect Red5 since we do not use Mina for HTTP requests; the only way it could possibly be exploited is with a specially crafted RTMPT client, if one was so inclined.

rawler commented 2 years ago

Good point R.E. not applicable to red5-client. Any good reason to not bump dependency to fixed version? (2.1.5)

mondain commented 2 years ago

If there was a road map, I'd say that's on there, but in actuality I haven't taken it on yet.