You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "divijvaidya (via GitHub)" <gi...@apache.org> on 2023/09/25 08:52:28 UTC
[GitHub] [kafka] divijvaidya opened a new pull request, #14438: KAFKA-15487: (CVE-2023-40167) Upgrade Jetty to 9.4.52.v20230823
divijvaidya opened a new pull request, #14438:
URL: https://github.com/apache/kafka/pull/14438
Current version of Jetty (9.4.51) has some known vulnerabilities such as https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40167 . The vulnerability is fixed in 9.4.52.
We cannot move to Jetty 10.x and Jetty 11.x because they required minimum of JDK-11, whereas Kafka currently supports JDK-8.
Release notes for Jetty 9.4.52 - https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823
This release (9.4.52) contains mostly security and CVE fixes. No breaking changes reported.
I will backport this to 3.3, 3.4, 3.5 and 3.6 branches.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] satishd commented on pull request #14438: KAFKA-15487: Upgrade Jetty to 9.4.52.v20230823
Posted by "satishd (via GitHub)" <gi...@apache.org>.
satishd commented on PR #14438:
URL: https://github.com/apache/kafka/pull/14438#issuecomment-1734142844
Merging it to trunk and 3.6 as the failed tests are unrelated to the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] divijvaidya commented on pull request #14438: KAFKA-15487: Upgrade Jetty to 9.4.52.v20230823
Posted by "divijvaidya (via GitHub)" <gi...@apache.org>.
divijvaidya commented on PR #14438:
URL: https://github.com/apache/kafka/pull/14438#issuecomment-1735115448
Since this PR addresses a CVE, I have backported this fix to all community supported version branches i.e. 3.4 and 3.5 (in addition to 3.6 backported by Satish)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [kafka] satishd merged pull request #14438: KAFKA-15487: Upgrade Jetty to 9.4.52.v20230823
Posted by "satishd (via GitHub)" <gi...@apache.org>.
satishd merged PR #14438:
URL: https://github.com/apache/kafka/pull/14438
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org