From b1bcdf751e5fcd35c66a6ebfd06c74d12fc572ff Mon Sep 17 00:00:00 2001
From: jitendra sharma <jitendra.sharma1@huawei.com>
Date: Thu, 23 Jan 2020 12:45:53 +0000
Subject: Change dependency version for netty-codec-http2

Issue-ID: CLI-246

Signed-off-by: jitendra sharma <jitendra.sharma1@huawei.com>
Change-Id: I89734d1062c202773a7e40ed353c1a738c5cbafe
---
 grpc/pom.xml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

(limited to 'grpc')

diff --git a/grpc/pom.xml b/grpc/pom.xml
index 75721607..e73be6b3 100644
--- a/grpc/pom.xml
+++ b/grpc/pom.xml
@@ -34,10 +34,23 @@
     <grpc.version>1.8.0</grpc.version>
   </properties>
   <dependencies>
+<!-- netty-codec-http2 excluded due to Security Issues:- CVE-2019-9512,CVE-2019-9514,CVE-2019-9515,CVE-2019-9518,CVE-2019-16869
+ and added invulnerable netty-codec-http2 4.1.42.Final -->
     <dependency>
       <groupId>io.grpc</groupId>
       <artifactId>grpc-netty</artifactId>
       <version>${grpc.version}</version>
+       <exclusions>
+        <exclusion>
+           <groupId>io.netty</groupId>
+            <artifactId>netty-codec-http2</artifactId>
+            </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-codec-http2</artifactId>
+        <version>4.1.42.Final</version>
     </dependency>
     <dependency>
       <groupId>io.grpc</groupId>
@@ -165,4 +178,4 @@
             </plugins>
         </pluginManagement>
   </build>
-</project>
\ No newline at end of file
+</project>
-- 
cgit 1.2.3-korg