Clojurians Log v2
datomic 2026-09-10
In Netty 4.1.131.Final , a critical CVE's and is used by https://mvnrepository.com/artifact/com.datomic/peer
Anyone knows if the peer library is affected by this?
Howdy @sigve.nordgaard short answer the peer library is not affected. Peers only act as TLS clients and never execute the affected code path at all.
A naive vulnerability scan will likely pull in the netty dep transitively from artemis-server. However, zero classes in the peer jar are going to touch Netty's api surface directly. This vulnerability would only apply for something acting as a TLS server. The peer lib only does outbound connections to the transactor and never actually parses a TLS client so you dont call SslClientHelloHandler.
@jaret Great, thanks! Its hard to keep up with all the CVE's popping up these days
Love your profile pic btw
I suppose you guys are on top of CVE announcements and will report if any are affecting datomic? If so, where will this be done?
Being radically honest, while we scan I always appreciate customer reports to make sure we have it. I've learned the hard way different scanners get different results. If we find a vulnerability and need to announce we do so on http://forum.datomic.com.
If you ever want to make a report you can open a ticket via email or the website. <mailto:Support@datomic.com|Support@datomic.com> or …
These links are in the bookmarks in case we lose chat history.
Got it 👍
Trying force a newer netty (4.1.137.Final) without the CVE to shut up my tracker. Someone tell me if this is a bad idea
stay on 4.1 netty and you should be ok