You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by GitBox <gi...@apache.org> on 2021/03/07 09:20:56 UTC
[GitHub] [zookeeper] ztzg opened a new pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
ztzg opened a new pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623
What do you know---I encountered a Jetty vulnerability while trying to
prepare a new 3.7.0 RC:
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:5.3.0:check (default-cli) on project zookeeper:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '0.0':
[ERROR]
[ERROR] jetty-server-9.4.35.v20201120.jar: CVE-2020-27223
[ERROR] jetty-http-9.4.35.v20201120.jar: CVE-2020-27223
https://nvd.nist.gov/vuln/detail/CVE-2020-27223 describes it as:
> In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive),
> 10.0.0, and 11.0.0 when Jetty handles a request containing multiple
> Accept headers with a large number of "quality" (i.e. q) parameters,
> the server may enter a denial of service (DoS) state due to high CPU
> usage processing those quality values, resulting in minutes of CPU
> time exhausted processing those quality values.
This changeset bumps Jetty to 9.4.38.v20210224, which is the latest
as of the commit date.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] arshadmohammad commented on pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
arshadmohammad commented on pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#issuecomment-794194594
One cppunit-tests test is failing on multiple PRs. @ztzg any idea why that test is failing..
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] arshadmohammad commented on a change in pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
arshadmohammad commented on a change in pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#discussion_r589472508
##########
File path: pom.xml
##########
@@ -468,7 +468,7 @@
<hamcrest.version>2.2</hamcrest.version>
<commons-cli.version>1.4</commons-cli.version>
<netty.version>4.1.59.Final</netty.version>
- <jetty.version>9.4.35.v20201120</jetty.version>
+ <jetty.version>9.4.38.v20210224</jetty.version>
<jackson.version>2.10.5.1</jackson.version>
<jline.version>2.14.6</jline.version>
<snappy.version>1.1.7.7</snappy.version>
Review comment:
> zookeeper-server/src/main/resources/lib/jetty-client-9.4.38.v20210224.LICENSE.txt
> File renamed without changes.
In master, generated zookeeper tar does not contain any jetty-client jar in zookeeper lib.
jetty-client-9.4.38.v20210224.LICENSE.txt can be removed.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] ztzg commented on pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
ztzg commented on pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#issuecomment-793640824
All active branches were affected.
As of right now, branches `branch-3.5` and `branch-3.6` have already been fixed.
This patch should be applied to branches `master`, `branch-3.7`, `branch-3.7.0`; it cherry-picks cleanly.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] ztzg commented on pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
ztzg commented on pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#issuecomment-792245491
All active branches are affected:
* `master`, `branch-3.7`, `branch-3.7.0`: This cherry-picks cleanly;
* `branch-3.6`: See https://github.com/apache/zookeeper/pull/1624;
* `branch-3.5`: See https://github.com/apache/zookeeper/pull/1625.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] asfgit closed pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
asfgit closed pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] ztzg commented on a change in pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
ztzg commented on a change in pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#discussion_r590145807
##########
File path: pom.xml
##########
@@ -468,7 +468,7 @@
<hamcrest.version>2.2</hamcrest.version>
<commons-cli.version>1.4</commons-cli.version>
<netty.version>4.1.59.Final</netty.version>
- <jetty.version>9.4.35.v20201120</jetty.version>
+ <jetty.version>9.4.38.v20210224</jetty.version>
<jackson.version>2.10.5.1</jackson.version>
<jline.version>2.14.6</jline.version>
<snappy.version>1.1.7.7</snappy.version>
Review comment:
Ah, interesting. I went by `zookeeper-server/target/lib`, but you are of course right that the tarball assembly script does not pick that one up. Fixed!
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] ztzg commented on pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
ztzg commented on pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#issuecomment-794361032
> One cppunit-tests test is failing on multiple PRs. @ztzg any idea why that test is failing..
No, I don't. Flakiness, I believe. It *looks* like there is much more variability in performance on the GitHub CI runners.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] arshadmohammad commented on a change in pull request #1623: ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223
Posted by GitBox <gi...@apache.org>.
arshadmohammad commented on a change in pull request #1623:
URL: https://github.com/apache/zookeeper/pull/1623#discussion_r589472508
##########
File path: pom.xml
##########
@@ -468,7 +468,7 @@
<hamcrest.version>2.2</hamcrest.version>
<commons-cli.version>1.4</commons-cli.version>
<netty.version>4.1.59.Final</netty.version>
- <jetty.version>9.4.35.v20201120</jetty.version>
+ <jetty.version>9.4.38.v20210224</jetty.version>
<jackson.version>2.10.5.1</jackson.version>
<jline.version>2.14.6</jline.version>
<snappy.version>1.1.7.7</snappy.version>
Review comment:
> zookeeper-server/src/main/resources/lib/jetty-client-9.4.38.v20210224.LICENSE.txt
> File renamed without changes.
In master, generated zookeeper tar does not contain any jetty-client jar in zookeeper lib.
jetty-client-9.4.38.v20210224.LICENSE.txt can be removed.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org