ZOOKEEPER-4023: dependency-check:check failing - Jetty 9.4.34.v20201102 - CVE-2020-27218 #1552
Conversation
…02 - CVE-2020-27218 Bump jetty.version to 9.4.35.v20201120. The [release notes](https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.35.v20201120) mention [issues 5605](eclipse/jetty.project#5605): > java.io.IOException: unconsumed input during http request parsing which seems to match the description of [CVE-2020-27218](http://cve.circl.lu/cve/CVE-2020-27218)
|
LGTM Can you please create a patch for branch-3.5? |
|
lgtm - one minor nit we can also address at the same time? (see comment) thanks! |
| https://www.eclipse.org/org/documents/epl-1.0/EPL-1.0.txt | ||
| or the Apache Software License 2.0 which is available at | ||
| https://www.apache.org/licenses/LICENSE-2.0 | ||
| terms of the Eclipse Public License 2.0 which is available at |
phunt
Dec 5, 2020
Contributor
It looks like jetty-client is no longer used - perhaps you can remove as part of this commit?
You can double check - take a look at the binary artifact, this jar is not included. thx.
It looks like jetty-client is no longer used - perhaps you can remove as part of this commit?
You can double check - take a look at the binary artifact, this jar is not included. thx.
ztzg
Dec 5, 2020
Author
Contributor
@phunt: This patch is for master, which still pulls jetty-client; I have noted that it should not be included in branch-3.5.
@eolivelli: Yes, will do so. And branch-3.6, too, as it does not cherry-pick clean.
@phunt: This patch is for master, which still pulls jetty-client; I have noted that it should not be included in branch-3.5.
@eolivelli: Yes, will do so. And branch-3.6, too, as it does not cherry-pick clean.
ztzg
Dec 7, 2020
Author
Contributor
(@phunt: In case you were suggesting to remove jetty-client from the POM in master, that would break ZOOKEEPER-3948: Introduce a deterministic runtime behavior injection framework for ZooKeeperServer testing.)
(@phunt: In case you were suggesting to remove jetty-client from the POM in master, that would break ZOOKEEPER-3948: Introduce a deterministic runtime behavior injection framework for ZooKeeperServer testing.)
|
LGTM |
|
Looks like some jenkins issue: |
|
sg - +1 Thanks! |
I think we have enough approvals, and have had enough time to ponder the changes in these three PRs :) Should I just merge them? @eolivelli, WDYT? |
|
Yes go head please |
|
Merged in |
Bump jetty.version to 9.4.35.v20201120.
The release notes
mention issue 5605:
which seems to match the description of
CVE-2020-27218