PHP agent linux agent vulnerabilities with library

[Ryan_Mansfield]

The latest version of the linux x64 php-agent (21.7.0.4560) is packaged with some out of date components: netty (4.1.38).
Currently this has some CVEs logged against it:

CVE-2019-20445

CVE-2019-20444

under the path: /proxy/lib/tp/grpc-netty-shaded-1.24.0.jar

Anyone know if this is something that can be patched, or if there is an intention to include a more up-to-date version in a future build?

[iamryan]

Hi @Ryan.Mansfield,

Thanks for reporting this. Let me share this with the right people and I'll report back!

[Manasa_H_G]

Hello @Ryan.Mansfield,

We are actively working on fixing the vulnerability.

Regards,

Manasa H G