Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability (#288)

CHANGES.md

@@ -12,6 +12,8 @@ Release Notes.
 * Add plugin to support Tomcat 10.x.
 * Save http status code regardless of it's status.
 * Upgrade byte-buddy to 1.12.13, and adopt byte-buddy APIs changes.
+* Upgrade gson to 2.8.9.
+* Upgrade netty-codec-http2 to 4.1.79.Final.
 
 #### Documentation
 

apm-protocol/apm-network/pom.xml

@@ -32,10 +32,30 @@
     </properties>
 
     <dependencies>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-handler-proxy</artifactId>
+            <version>${netty.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-codec-http2</artifactId>
+            <version>${netty.version}</version>
+        </dependency>
         <dependency>
             <groupId>io.grpc</groupId>
             <artifactId>grpc-netty</artifactId>
             <version>${grpc.version}</version>
+            <exclusions>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
+                <exclusion>
+                    <groupId>netty-handler-proxy</groupId>
+                    <artifactId>io.netty</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.grpc</groupId>

apm-sniffer/apm-agent-core/pom.xml

@@ -33,7 +33,7 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <guava.version>20.0</guava.version>
+        <guava.version>30.1.1-jre</guava.version>
         <wiremock.version>2.6.0</wiremock.version>
         <netty-tcnative-boringssl-static.version>2.0.7.Final</netty-tcnative-boringssl-static.version>
         <os-maven-plugin.version>1.4.1.Final</os-maven-plugin.version>
@@ -109,6 +109,10 @@
                     <artifactId>mockito-core</artifactId>
                     <groupId>org.mockito</groupId>
                 </exclusion>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
             </exclusions>
             <scope>test</scope>
         </dependency>

dist-material/LICENSE

@@ -217,10 +217,10 @@ The text of each license is the standard Apache 2.0 license.
 
     raphw (byte-buddy) 1.12.13: http://bytebuddy.net/ , Apache 2.0
     Google: grpc-java 1.44.0: https://github.com/grpc/grpc-java, Apache 2.0
-    Google: gson 2.8.6: https://github.com/google/gson , Apache 2.0
+    Google: gson 2.8.9: https://github.com/google/gson , Apache 2.0
     Google: proto-google-common-protos 2.0.1: https://github.com/googleapis/googleapis , Apache 2.0
     Google: jsr305 3.0.2: http://central.maven.org/maven2/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.pom , Apache 2.0
-    netty 4.1.72: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
+    netty 4.1.79: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
 
 ========================================================================
 BSD licenses

pom.xml

@@ -88,7 +88,8 @@
         <!-- core lib dependency -->
         <bytebuddy.version>1.12.13</bytebuddy.version>
         <grpc.version>1.44.0</grpc.version>
-        <gson.version>2.8.6</gson.version>
+        <netty.version>4.1.79.Final</netty.version>
+        <gson.version>2.8.9</gson.version>
         <os-maven-plugin.version>1.6.2</os-maven-plugin.version>
         <protobuf-maven-plugin.version>0.6.1</protobuf-maven-plugin.version>
         <com.google.protobuf.protoc.version>3.17.3</com.google.protobuf.protoc.version>

test/e2e/base/pom.xml

@@ -52,7 +52,7 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <spring.boot.version>2.2.5.RELEASE</spring.boot.version>
-        <guava.version>28.2-jre</guava.version>
+        <guava.version>30.1.1-jre</guava.version>
         <lombok.version>1.18.20</lombok.version>
     </properties>
 

test/plugin/pom.xml

@@ -42,8 +42,8 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <junit.version>4.11</junit.version>
-        <guava.version>20.0</guava.version>
-        <gson.version>2.8.5</gson.version>
+        <guava.version>30.1.1-jre</guava.version>
+        <gson.version>2.8.9</gson.version>
         <lombok.version>1.18.20</lombok.version>
         <snakeyaml.version>1.24</snakeyaml.version>