You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by "pfcoperez (via GitHub)" <gi...@apache.org> on 2025/02/03 10:17:22 UTC
[PR] Bump patch release of jetty to include CVE fix for `CVE-2024-6763` [zookeeper]
pfcoperez opened a new pull request, #2220:
URL: https://github.com/apache/zookeeper/pull/2220
With https://github.com/apache/zookeeper/pull/2202 one of two CVEs around Jetty dependency were addressed.
Unfortunately, at that moment `CVE-2024-6763` was not removed as Jetty maintainers had not published a patch release fixing it (https://issues.apache.org/jira/browse/ZOOKEEPER-4876?focusedCommentId=17890378&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-17890378).
That patch release is still not officially released according to their release notes but the truth is that
maven repository has it: [Central Repository: org/eclipse/jetty/jetty-http/9.4.57.v20241219](https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-http/9.4.57.v20241219/) and it has the backport for the CVE remediation:
This PR bumps Jetty dependency to this patch release thus effectively fixing the second CVE in https://issues.apache.org/jira/browse/ZOOKEEPER-4876
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "cnauroth (via GitHub)" <gi...@apache.org>.
cnauroth commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2766730098
> @cnauroth Sorry for the direct ping, I am abusing the fact that you took the time and effort of reviewing this PR. Do you think there is something else I can do to help moving this change forward 🙏 ?
>
> Thank you again for all your time and help.
Hello @pfcoperez . Sorry for the delay. On ZooKeeper, we aim for two +1s from committers before committing changes. I'll try directly asking a few other committers: @anmolnar , @eolivelli , @tisonkun , @kezhuw .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2696818817
> Hello @pfcoperez . Thank you for the patch. Since [CVE-2024-6763](https://github.com/advisories/GHSA-qh8g-58pp-2wxh) is now fixed, can you please remove the suppression from the OWASP configuration?
>
> https://github.com/apache/zookeeper/blob/master/owaspSuppressions.xml#L21-L25
>
> CC: @anmolnar who previously worked on #2202 .
Thanks you @cnauroth , sure I'll do it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2697906029
> > Hello @pfcoperez . Thank you for the patch. Since [CVE-2024-6763](https://github.com/advisories/GHSA-qh8g-58pp-2wxh) is now fixed, can you please remove the suppression from the OWASP configuration?
> > https://github.com/apache/zookeeper/blob/master/owaspSuppressions.xml#L21-L25
> > CC: @anmolnar who previously worked on #2202 .
>
> Thanks you @cnauroth , sure I'll do it.
Done in f6e3af3ab792858187240b959dcc870116cbf9b0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2772494771
This is the backport PR to branch-3.9
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2697904701
> @pfcoperez , can you also please update all of the Jetty license files listed here?
>
> https://github.com/apache/zookeeper/tree/master/zookeeper-server/src/main/resources/lib
>
> Run `git mv` commands to rename the files from "9.4.53.v20231009.LICENSE.txt" to "9.4.57.v20241219.LICENSE.txt". The contents of the files won't need to change.
Done in 28bffa27435a034edea5c42bdfc1b2d917a3724a
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "cnauroth (via GitHub)" <gi...@apache.org>.
cnauroth commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2702062831
@pfcoperez , great! I assigned the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Bump patch release of jetty to include CVE fix for `CVE-2024-6763` [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2669026910
Requests at ZooKeeper dev mailing list: https://lists.apache.org/thread/302tr7vl9yydp3fvcbdyykwp8om3xr9k
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2760781941
@cnauroth Sorry for the direct ping, I am abusing the fact that you took the time and effort of reviewing this PR. Do you think there is something else I can do to help moving this change forward :pray: ?
Thank you again for all your time and help/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2768703679
Thank you folks :bow: Should I back-port 3.9 branch too?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "pfcoperez (via GitHub)" <gi...@apache.org>.
pfcoperez commented on PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220#issuecomment-2700550833
> +1. I'll wait for one more committer to review and +1 before I commit.
>
Thank you @cnauroth !
> Thank you for this patch, @pfcoperez ! I would like to assign [ZOOKEEPER-4900](https://issues.apache.org/jira/browse/ZOOKEEPER-4900) to you for proper tracking of the effort. Do you have an ASF JIRA account? If not, you can request one here:
>
> https://selfserve.apache.org/jira-account.html
>
> Let me know your ASF JIRA ID, and I can assign the bug.
I do have a Jira account. My user id is `pfcoperez` and I think the account ID is `JIRAUSER281850`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] ZOOKEEPER-4900: Bump patch release of jetty to include CVE fix for CVE-2024-6763 [zookeeper]
Posted by "kezhuw (via GitHub)" <gi...@apache.org>.
kezhuw merged PR #2220:
URL: https://github.com/apache/zookeeper/pull/2220
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org