Fix HTTP/2 vulnerabilities

fbiville commented 5 years ago

There are a few HTTP/2 vulnerabilities that have been disclosed recently.

This affects:

[x] (see commit) the new Java invoker (gRPC must be >= 1.23.0)
- [x] (see PR) the current Java invoker (Netty must >= 4.1.39.Final). This a temporary workaround needed until a new release of spring-boot-starter-webflux includes a new release of spring-boot-starter-reactor-netty which must include a new release (0.9.0.RC1 ~ out by next week) of reactor-netty with the right Netty version.
- [ ] after the above change, release 0.1.5 of the java-function-invoker and update the buildpack to use this version
- [ ] (see libfnbuildpack PR and Node fn BP WIP PR) the Node function buildpack (Node must be either >= 12.8.1 or >= 10.16.3 (LTS) or >= 8.18.1 (LTS)), which requires cloudfoundry/node-engine-cnb >= v0.0.37. This new buildpack depends on a newer, incompatible lifecycle API which in turn requires to update our riff builder and all the other riff buildpacks.

scothis commented 5 years ago

@fbiville is there more to do here? All of the invokers and buildpacks have been updated.

fbiville commented 5 years ago

@fbiville is there more to do here? All of the invokers and buildpacks have been updated.

Apart from publishing a new release, I think we're good.

projectriff / riff