Ktor: Update netty to mitigate CVE-2019-16869

[riedeljan]

Please update netty_server (currently 4.1.37.Final) to latest recommended stable (4.1.43.Final) to mitigate the impact of CVE-2019-16869.

[e5l]

Hi @riedeljan, thanks for the report. We'll fix it.
You can add 4.1.43 netty dependency by hand to override the ktor version for now as workaround.

[herveDarritchon]

In gradle, I put a block like this :

configurations.all {
    resolutionStrategy {
        // To be deleted when issue https://github.com/ktorio/ktor/issues/1452 is closed
        force("io.netty:netty-codec-http2:4.1.43.Final")
        force("io.netty:netty-transport-native-kqueue:4.1.43.Final")
        force("io.netty:netty-transport-native-epoll:4.1.43.Final")
        force("io.netty:netty-codec-http:4.1.43.Final")
        force("io.netty:netty-handler:4.1.43.Final")
        force("io.netty:netty-codec:4.1.43.Final")
        force("io.netty:netty-transport:4.1.43.Final")
        force("io.netty:netty-transport:4.1.43.Final")
        force("io.netty:netty-buffer:4.1.43.Final")
        force("io.netty:netty-resolver:4.1.43.Final")
        force("io.netty:netty-common:4.1.43.Final")
    }
}

If it helps ...