You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@spark.apache.org by "Sajith A (Jira)" <ji...@apache.org> on 2021/08/04 15:19:00 UTC
[jira] [Commented] (SPARK-35870) Upgrade Jetty to 9.4.42
[ https://issues.apache.org/jira/browse/SPARK-35870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17393258#comment-17393258 ]
Sajith A commented on SPARK-35870:
----------------------------------
CVE-2021-28169 is also present in Spark v2.4.8 (See [https://github.com/apache/spark/blob/v2.4.8/pom.xml#L137).] [~sarutak] Can we open this issue and add 2.4.8 to the affected versions? I can open a PR to fix in [branch-2.4|https://github.com/apache/spark/blob/branch-2.4/pom.xml#L137].
> Upgrade Jetty to 9.4.42
> -----------------------
>
> Key: SPARK-35870
> URL: https://issues.apache.org/jira/browse/SPARK-35870
> Project: Spark
> Issue Type: Bug
> Components: Build
> Affects Versions: 3.2.0
> Reporter: Kousuke Saruta
> Assignee: Kousuke Saruta
> Priority: Minor
> Fix For: 3.2.0
>
>
> Recently, CVE-2021-28169 was reported and 9.4.40 which Spark uses in the current master affects.
> https://nvd.nist.gov/vuln/detail/CVE-2021-28169.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org