You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@zookeeper.apache.org by Enrico Olivelli <eo...@gmail.com> on 2021/01/05 11:25:51 UTC
Re: [VOTE] Apache ZooKeeper release 3.5.9 candidate 0
What's the status of this VOTE ?
Enrico
Il giorno mar 8 dic 2020 alle ore 21:28 Damien Diederen <
ddiederen@sinenomine.net> ha scritto:
>
> Hi Andor,
>
> > Is this not the same Jar that I’ve upgraded recently, because of a CVE?
>
> It is. You updated it for CVE-2020-27216, and this is now for
> CVE-2020-27218!
>
> Cheers, -D
>
>
>
>
> >> On 2020. Dec 5., at 22:03, Patrick Hunt <ph...@apache.org> wrote:
> >>
> >> Thanks Damien! I reviewed and it looks good except for one small
> comment I
> >> hope we can also address (commented on PR).
> >>
> >> Regards,
> >>
> >> Patrick
> >>
> >> On Sat, Dec 5, 2020 at 12:05 PM Damien Diederen <
> ddiederen@sinenomine.net>
> >> wrote:
> >>
> >>>
> >>> Hi Patrick, all,
> >>>
> >>>> -1 - the dependency check is failing with a known CVE
> >>>>
> >>>> $ mvn clean package -DskipTests dependency-check:check
> >>>> ...
> >>>> [ERROR] One or more dependencies were identified with vulnerabilities
> >>> that
> >>>> have a CVSS score greater than or equal to '0.0':
> >>>> [ERROR]
> >>>> [ERROR] jetty-server-9.4.34.v20201102.jar: CVE-2020-27218
> >>>> [ERROR] jetty-http-9.4.34.v20201102.jar: CVE-2020-27218
> >>>
> >>> For the (mailing list) record, I have created:
> >>>
> >>> https://issues.apache.org/jira/browse/ZOOKEEPER-4023
> >>> https://github.com/apache/zookeeper/pull/1552
> >>>
> >>> Best, -D
> >>>
>
Re: [VOTE] Apache ZooKeeper release 3.5.9 candidate 0
Posted by Norbert Kalmar <nk...@cloudera.com.INVALID>.
Sorry for missing the notification. I did an rc1 but totally missed one CVE
and only realized when doing my final checks. So I will have an rc2 instead
shortly.
- Norbert
On Tue, Jan 5, 2021 at 5:23 PM Enrico Olivelli <eo...@gmail.com> wrote:
> Il giorno mar 5 gen 2021 alle ore 15:48 Norbert Kalmar
> <nk...@cloudera.com.invalid> ha scritto:
>
> > It failed due to the CVE, and the fix was not a clean cherry-pick to 3.5.
> >
>
> Thank you Norbert,
> I didn't find any official "CANCELLED" response.
> no hurry
>
> Enrico
>
>
> > Then Holidays hit, and I didn't do RC2. Picking it up now, and checking
> > what needs to be backported and doing an RC2.
> >
> > - Norbert
> >
> > On Tue, Jan 5, 2021 at 12:26 PM Enrico Olivelli <eo...@gmail.com>
> > wrote:
> >
> > > What's the status of this VOTE ?
> > >
> > > Enrico
> > >
> > > Il giorno mar 8 dic 2020 alle ore 21:28 Damien Diederen <
> > > ddiederen@sinenomine.net> ha scritto:
> > >
> > > >
> > > > Hi Andor,
> > > >
> > > > > Is this not the same Jar that I’ve upgraded recently, because of a
> > CVE?
> > > >
> > > > It is. You updated it for CVE-2020-27216, and this is now for
> > > > CVE-2020-27218!
> > > >
> > > > Cheers, -D
> > > >
> > > >
> > > >
> > > >
> > > > >> On 2020. Dec 5., at 22:03, Patrick Hunt <ph...@apache.org> wrote:
> > > > >>
> > > > >> Thanks Damien! I reviewed and it looks good except for one small
> > > > comment I
> > > > >> hope we can also address (commented on PR).
> > > > >>
> > > > >> Regards,
> > > > >>
> > > > >> Patrick
> > > > >>
> > > > >> On Sat, Dec 5, 2020 at 12:05 PM Damien Diederen <
> > > > ddiederen@sinenomine.net>
> > > > >> wrote:
> > > > >>
> > > > >>>
> > > > >>> Hi Patrick, all,
> > > > >>>
> > > > >>>> -1 - the dependency check is failing with a known CVE
> > > > >>>>
> > > > >>>> $ mvn clean package -DskipTests dependency-check:check
> > > > >>>> ...
> > > > >>>> [ERROR] One or more dependencies were identified with
> > > vulnerabilities
> > > > >>> that
> > > > >>>> have a CVSS score greater than or equal to '0.0':
> > > > >>>> [ERROR]
> > > > >>>> [ERROR] jetty-server-9.4.34.v20201102.jar: CVE-2020-27218
> > > > >>>> [ERROR] jetty-http-9.4.34.v20201102.jar: CVE-2020-27218
> > > > >>>
> > > > >>> For the (mailing list) record, I have created:
> > > > >>>
> > > > >>> https://issues.apache.org/jira/browse/ZOOKEEPER-4023
> > > > >>> https://github.com/apache/zookeeper/pull/1552
> > > > >>>
> > > > >>> Best, -D
> > > > >>>
> > > >
> > >
> >
>
Re: [VOTE] Apache ZooKeeper release 3.5.9 candidate 0
Posted by Enrico Olivelli <eo...@gmail.com>.
Il giorno mar 5 gen 2021 alle ore 15:48 Norbert Kalmar
<nk...@cloudera.com.invalid> ha scritto:
> It failed due to the CVE, and the fix was not a clean cherry-pick to 3.5.
>
Thank you Norbert,
I didn't find any official "CANCELLED" response.
no hurry
Enrico
> Then Holidays hit, and I didn't do RC2. Picking it up now, and checking
> what needs to be backported and doing an RC2.
>
> - Norbert
>
> On Tue, Jan 5, 2021 at 12:26 PM Enrico Olivelli <eo...@gmail.com>
> wrote:
>
> > What's the status of this VOTE ?
> >
> > Enrico
> >
> > Il giorno mar 8 dic 2020 alle ore 21:28 Damien Diederen <
> > ddiederen@sinenomine.net> ha scritto:
> >
> > >
> > > Hi Andor,
> > >
> > > > Is this not the same Jar that I’ve upgraded recently, because of a
> CVE?
> > >
> > > It is. You updated it for CVE-2020-27216, and this is now for
> > > CVE-2020-27218!
> > >
> > > Cheers, -D
> > >
> > >
> > >
> > >
> > > >> On 2020. Dec 5., at 22:03, Patrick Hunt <ph...@apache.org> wrote:
> > > >>
> > > >> Thanks Damien! I reviewed and it looks good except for one small
> > > comment I
> > > >> hope we can also address (commented on PR).
> > > >>
> > > >> Regards,
> > > >>
> > > >> Patrick
> > > >>
> > > >> On Sat, Dec 5, 2020 at 12:05 PM Damien Diederen <
> > > ddiederen@sinenomine.net>
> > > >> wrote:
> > > >>
> > > >>>
> > > >>> Hi Patrick, all,
> > > >>>
> > > >>>> -1 - the dependency check is failing with a known CVE
> > > >>>>
> > > >>>> $ mvn clean package -DskipTests dependency-check:check
> > > >>>> ...
> > > >>>> [ERROR] One or more dependencies were identified with
> > vulnerabilities
> > > >>> that
> > > >>>> have a CVSS score greater than or equal to '0.0':
> > > >>>> [ERROR]
> > > >>>> [ERROR] jetty-server-9.4.34.v20201102.jar: CVE-2020-27218
> > > >>>> [ERROR] jetty-http-9.4.34.v20201102.jar: CVE-2020-27218
> > > >>>
> > > >>> For the (mailing list) record, I have created:
> > > >>>
> > > >>> https://issues.apache.org/jira/browse/ZOOKEEPER-4023
> > > >>> https://github.com/apache/zookeeper/pull/1552
> > > >>>
> > > >>> Best, -D
> > > >>>
> > >
> >
>
Re: [VOTE] Apache ZooKeeper release 3.5.9 candidate 0
Posted by Norbert Kalmar <nk...@cloudera.com.INVALID>.
It failed due to the CVE, and the fix was not a clean cherry-pick to 3.5.
Then Holidays hit, and I didn't do RC2. Picking it up now, and checking
what needs to be backported and doing an RC2.
- Norbert
On Tue, Jan 5, 2021 at 12:26 PM Enrico Olivelli <eo...@gmail.com> wrote:
> What's the status of this VOTE ?
>
> Enrico
>
> Il giorno mar 8 dic 2020 alle ore 21:28 Damien Diederen <
> ddiederen@sinenomine.net> ha scritto:
>
> >
> > Hi Andor,
> >
> > > Is this not the same Jar that I’ve upgraded recently, because of a CVE?
> >
> > It is. You updated it for CVE-2020-27216, and this is now for
> > CVE-2020-27218!
> >
> > Cheers, -D
> >
> >
> >
> >
> > >> On 2020. Dec 5., at 22:03, Patrick Hunt <ph...@apache.org> wrote:
> > >>
> > >> Thanks Damien! I reviewed and it looks good except for one small
> > comment I
> > >> hope we can also address (commented on PR).
> > >>
> > >> Regards,
> > >>
> > >> Patrick
> > >>
> > >> On Sat, Dec 5, 2020 at 12:05 PM Damien Diederen <
> > ddiederen@sinenomine.net>
> > >> wrote:
> > >>
> > >>>
> > >>> Hi Patrick, all,
> > >>>
> > >>>> -1 - the dependency check is failing with a known CVE
> > >>>>
> > >>>> $ mvn clean package -DskipTests dependency-check:check
> > >>>> ...
> > >>>> [ERROR] One or more dependencies were identified with
> vulnerabilities
> > >>> that
> > >>>> have a CVSS score greater than or equal to '0.0':
> > >>>> [ERROR]
> > >>>> [ERROR] jetty-server-9.4.34.v20201102.jar: CVE-2020-27218
> > >>>> [ERROR] jetty-http-9.4.34.v20201102.jar: CVE-2020-27218
> > >>>
> > >>> For the (mailing list) record, I have created:
> > >>>
> > >>> https://issues.apache.org/jira/browse/ZOOKEEPER-4023
> > >>> https://github.com/apache/zookeeper/pull/1552
> > >>>
> > >>> Best, -D
> > >>>
> >
>