[jira] [Commented] (HBASE-21296) [2.1] Upgrade Jetty dependencies to latest in major-line

["Pankaj Kumar (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HBASE-21296?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16736805#comment-16736805 ] 

Pankaj Kumar commented on HBASE-21296:
--------------------------------------

Following CVE observed in jetty,
 * [CVE-2017-7657|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7657]
 * [CVE-2017-7658|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7658]
 * [CVE-2017-7656|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7656]
 * [CVE-2018-12536|https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-12536]

We need to upgrade the jetty jar in all the affected branches.

> [2.1] Upgrade Jetty dependencies to latest in major-line
> --------------------------------------------------------
>
>                 Key: HBASE-21296
>                 URL: https://issues.apache.org/jira/browse/HBASE-21296
>             Project: HBase
>          Issue Type: Task
>          Components: dependencies
>            Reporter: Josh Elser
>            Assignee: Josh Elser
>            Priority: Major
>             Fix For: 2.1.3
>
>         Attachments: HBASE-21282.001.branch-2.0.patch
>
>
> Looks like we have dependencies on both jetty 9.2 and 9.3, but we're lagging pretty far behind in both. We can upgrade both of these to the latest (august 2018).
>  
> I'll also have to take a look at why we're using two separate versions (maybe we didn't want to switch from jetty-jsp to apache-jsp on 9.2->9.3?). Not sure if there's a good reason for this.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)