Bump Netty version to mitigate CVE-2020-11612

As per https://nvd.nist.gov/vuln/detail/CVE-2020-11612, there is a known vulnerability with the current Netty version used by ktor - 4.1.44.Final

I’ll raise a PR to bump to 4.1.48.Final

[xcq1]

Is this CVE not relevant when using ktor or am I missing something? It strikes me as a bit odd to leave a fix for a ‘score critical’ CVE laying around for a month if it can easily be solved by bumping a version?

[alyssa-glean]

There is a workaround whilst my PR remains outstanding - you can force the resolution yourself in your build.gradle:

configurations.all {
    resolutionStrategy {
        // To be deleted when issue https://github.com/ktorio/ktor/pull/1779 is released and we bump ktor
        force("io.netty:netty-codec-http2:4.1.48.Final")
        force("io.netty:netty-transport-native-kqueue:4.1.48.Final")
        force("io.netty:netty-transport-native-epoll:4.1.48.Final")
        force("io.netty:netty-codec-http:4.1.48.Final")
        force("io.netty:netty-handler:4.1.48.Final")
        force("io.netty:netty-codec:4.1.48.Final")
        force("io.netty:netty-transport:4.1.48.Final")
        force("io.netty:netty-transport:4.1.48.Final")
        force("io.netty:netty-buffer:4.1.48.Final")
        force("io.netty:netty-resolver:4.1.48.Final")
        force("io.netty:netty-common:4.1.48.Final")
    }
}

Not ideal to have to maintain that, of course, but it will at least patch the CVE in your application and make the OWASP check go green if you’ve automated it someplace 😄