hyperledger / fabric-gateway

Go, Node and Java client API for Hyperledger Fabric v2.4+
https://hyperledger.github.io/fabric-gateway/
Apache License 2.0
150 stars 87 forks source link

Update dependencies to mitigate CVE-2023-44487 #661

Closed bestbeforetoday closed 9 months ago

bestbeforetoday commented 9 months ago

This vulnerability can be exploited in gRPC servers (not clients) so should not directly impact the Fabric Gateway client API. However, updates to gRPC Java dependencies enables compatibility with Netty version 4.1.101.Final, which contains mitigations to this vulnerability and supports client applications that also expose gRPC services.

See:

Also:

Closes #659 Closes #660