You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@geode.apache.org by ji...@apache.org on 2026/08/07 13:25:11 UTC
(geode) branch develop updated: [GEODE-10605] Remediation of CVE-2026-10050 (#8031)
This is an automated email from the ASF dual-hosted git repository.
JinwooHwang pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/geode.git
The following commit(s) were added to refs/heads/develop by this push:
new b507bd3072 [GEODE-10605] Remediation of CVE-2026-10050 (#8031)
b507bd3072 is described below
commit b507bd3072f7fb10713cb26485787e64237fc538
Author: Jinwoo Hwang <92...@users.noreply.github.com>
AuthorDate: Fri Aug 7 09:25:00 2026 -0400
[GEODE-10605] Remediation of CVE-2026-10050 (#8031)
* GEODE-10605 Remediation of CVE-2026-10050
* resolved merge conflict
* resolved merge conflict
* Triggering github action
---
README.md | 1 -
.../gradle/plugins/DependencyConstraints.groovy | 2 +-
.../session/tests/GenericAppServerInstall.java | 2 +-
.../integrationTest/resources/assembly_content.txt | 34 +++++++++++-----------
.../resources/gfsh_dependency_classpath.txt | 34 +++++++++++-----------
.../resources/dependency_classpath.txt | 34 +++++++++++-----------
6 files changed, 53 insertions(+), 54 deletions(-)
diff --git a/README.md b/README.md
index 4dd74940bb..c74236bb49 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,6 @@
[](http://geode.apache.org)
[](https://concourse.apachegeode-ci.info/teams/main/pipelines/apache-develop-main) [](https://www.apache.org/licenses/LICENSE-2.0) [](http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.apache.geode%22) [![ho [...]
-
</div>
## Contents
diff --git a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
index 0c65eb7a49..4d84463f4a 100644
--- a/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
+++ b/build-tools/geode-dependency-management/src/main/groovy/org/apache/geode/gradle/plugins/DependencyConstraints.groovy
@@ -85,7 +85,7 @@ class DependencyConstraints {
// at o.a.g.sessions.tests.GenericAppServerInstall.java
// Jetty 12.0.x for Jakarta EE 10 (Servlet 6.0) compatibility
// Jetty 12 reorganized modules under ee10, ee9, ee8 packages
- deps.put("jetty.version", "12.0.33")
+ deps.put("jetty.version", "12.0.37")
// These versions are referenced in test.gradle, which is aggressively injected into all projects.
deps.put("junit.version", "4.13.2")
diff --git a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java
index b2fc46e851..59edba3821 100644
--- a/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java
+++ b/geode-assembly/src/distributedTest/java/org/apache/geode/session/tests/GenericAppServerInstall.java
@@ -34,7 +34,7 @@ import java.util.function.IntSupplier;
* specific code outside of the {@link GenericAppServerVersion}.
*/
public class GenericAppServerInstall extends ContainerInstall {
- private static final String JETTY_VERSION = "12.0.33";
+ private static final String JETTY_VERSION = "12.0.37";
/**
* Get the version number, download URL, and container name of a generic app server using
diff --git a/geode-assembly/src/integrationTest/resources/assembly_content.txt b/geode-assembly/src/integrationTest/resources/assembly_content.txt
index bb2eb38864..3e055a4b32 100644
--- a/geode-assembly/src/integrationTest/resources/assembly_content.txt
+++ b/geode-assembly/src/integrationTest/resources/assembly_content.txt
@@ -920,9 +920,9 @@ lib/ST4-4.3.3.jar
lib/angus-activation-2.0.0.jar
lib/antlr-2.7.7.jar
lib/antlr-runtime-3.5.2.jar
-lib/asm-9.9.1.jar
-lib/asm-commons-9.9.1.jar
-lib/asm-tree-9.9.1.jar
+lib/asm-9.10.1.jar
+lib/asm-commons-9.10.1.jar
+lib/asm-tree-9.10.1.jar
lib/bcprov-jdk18on-1.85.jar
lib/classgraph-4.8.147.jar
lib/classmate-1.5.1.jar
@@ -987,20 +987,20 @@ lib/jakarta.xml.bind-api-4.0.2.jar
lib/jaxb-core-4.0.2.jar
lib/jaxb-runtime-4.0.2.jar
lib/jboss-logging-3.4.3.Final.jar
-lib/jetty-ee-12.0.33.jar
-lib/jetty-ee10-annotations-12.0.33.jar
-lib/jetty-ee10-plus-12.0.33.jar
-lib/jetty-ee10-servlet-12.0.33.jar
-lib/jetty-ee10-webapp-12.0.33.jar
-lib/jetty-http-12.0.33.jar
-lib/jetty-io-12.0.33.jar
-lib/jetty-jndi-12.0.33.jar
-lib/jetty-plus-12.0.33.jar
-lib/jetty-security-12.0.33.jar
-lib/jetty-server-12.0.33.jar
-lib/jetty-session-12.0.33.jar
-lib/jetty-util-12.0.33.jar
-lib/jetty-xml-12.0.33.jar
+lib/jetty-ee-12.0.37.jar
+lib/jetty-ee10-annotations-12.0.37.jar
+lib/jetty-ee10-plus-12.0.37.jar
+lib/jetty-ee10-servlet-12.0.37.jar
+lib/jetty-ee10-webapp-12.0.37.jar
+lib/jetty-http-12.0.37.jar
+lib/jetty-io-12.0.37.jar
+lib/jetty-jndi-12.0.37.jar
+lib/jetty-plus-12.0.37.jar
+lib/jetty-security-12.0.37.jar
+lib/jetty-server-12.0.37.jar
+lib/jetty-session-12.0.37.jar
+lib/jetty-util-12.0.37.jar
+lib/jetty-xml-12.0.37.jar
lib/jgroups-3.6.20.Final.jar
lib/jline-builtins-3.26.3.jar
lib/jline-console-3.26.3.jar
diff --git a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
index f3a74307da..2b4a97f4ee 100644
--- a/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
+++ b/geode-assembly/src/integrationTest/resources/gfsh_dependency_classpath.txt
@@ -79,13 +79,13 @@ micrometer-core-1.15.12.jar
HdrHistogram-2.2.2.jar
fastutil-8.5.8.jar
jakarta.resource-api-2.1.0.jar
-jetty-ee10-annotations-12.0.33.jar
-jetty-ee10-plus-12.0.33.jar
+jetty-ee10-annotations-12.0.37.jar
+jetty-ee10-plus-12.0.37.jar
jakarta.enterprise.cdi-api-4.0.1.jar
jakarta.interceptor-api-2.1.0.jar
jakarta.annotation-api-2.1.1.jar
-jetty-ee10-webapp-12.0.33.jar
-jetty-ee10-servlet-12.0.33.jar
+jetty-ee10-webapp-12.0.37.jar
+jetty-ee10-servlet-12.0.37.jar
jakarta.servlet-api-6.0.0.jar
jakarta.transaction-api-2.0.1.jar
joda-time-2.12.7.jar
@@ -95,11 +95,11 @@ shiro-hashes-argon2-2.1.0.jar
shiro-hashes-bcrypt-2.1.0.jar
shiro-crypto-hash-2.1.0.jar
bcprov-jdk18on-1.85.jar
-jetty-ee-12.0.33.jar
-jetty-session-12.0.33.jar
-jetty-plus-12.0.33.jar
-jetty-security-12.0.33.jar
-jetty-server-12.0.33.jar
+jetty-ee-12.0.37.jar
+jetty-session-12.0.37.jar
+jetty-plus-12.0.37.jar
+jetty-security-12.0.37.jar
+jetty-server-12.0.37.jar
snappy-0.5.jar
jgroups-3.6.20.Final.jar
shiro-cache-2.1.0.jar
@@ -108,13 +108,13 @@ shiro-config-core-2.1.0.jar
shiro-event-2.1.0.jar
shiro-crypto-core-2.1.0.jar
shiro-lang-2.1.0.jar
-jetty-xml-12.0.33.jar
-jetty-http-12.0.33.jar
-jetty-io-12.0.33.jar
+jetty-xml-12.0.37.jar
+jetty-http-12.0.37.jar
+jetty-io-12.0.37.jar
spring-boot-starter-logging-3.3.13.jar
jul-to-slf4j-2.0.17.jar
-jetty-jndi-12.0.33.jar
-jetty-util-12.0.33.jar
+jetty-jndi-12.0.37.jar
+jetty-util-12.0.37.jar
slf4j-api-2.0.17.jar
jackson-annotations-2.21.jar
micrometer-observation-1.15.12.jar
@@ -130,9 +130,9 @@ jline-style-3.26.3.jar
jline-terminal-3.26.3.jar
ST4-4.3.3.jar
txw2-4.0.2.jar
-asm-commons-9.9.1.jar
-asm-tree-9.9.1.jar
-asm-9.9.1.jar
+asm-commons-9.10.1.jar
+asm-tree-9.10.1.jar
+asm-9.10.1.jar
reactive-streams-1.0.4.jar
jline-native-3.26.3.jar
antlr-runtime-3.5.2.jar
diff --git a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
index 2ba9e1f138..837fc21e6a 100644
--- a/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
+++ b/geode-server-all/src/integrationTest/resources/dependency_classpath.txt
@@ -48,10 +48,10 @@ spring-shell-core-3.3.3.jar
commons-io-2.19.0.jar
micrometer-core-1.15.12.jar
jakarta.resource-api-2.1.0.jar
-jetty-ee10-annotations-12.0.33.jar
+jetty-ee10-annotations-12.0.37.jar
spring-boot-starter-validation-3.3.13.jar
spring-boot-starter-3.3.13.jar
-jetty-ee10-plus-12.0.33.jar
+jetty-ee10-plus-12.0.37.jar
jakarta.enterprise.cdi-api-4.0.1.jar
jakarta.interceptor-api-2.1.0.jar
jakarta.annotation-api-2.1.1.jar
@@ -90,30 +90,30 @@ commons-collections-3.2.2.jar
commons-digester-2.1.jar
commons-logging-1.3.5.jar
HdrHistogram-2.2.2.jar
-jetty-ee10-webapp-12.0.33.jar
-jetty-ee10-servlet-12.0.33.jar
+jetty-ee10-webapp-12.0.37.jar
+jetty-ee10-servlet-12.0.37.jar
jakarta.servlet-api-6.0.0.jar
joda-time-2.12.7.jar
shiro-hashes-argon2-2.1.0.jar
shiro-hashes-bcrypt-2.1.0.jar
shiro-crypto-hash-2.1.0.jar
bcprov-jdk18on-1.85.jar
-jetty-ee-12.0.33.jar
-jetty-session-12.0.33.jar
-jetty-plus-12.0.33.jar
-jetty-security-12.0.33.jar
-jetty-server-12.0.33.jar
+jetty-ee-12.0.37.jar
+jetty-session-12.0.37.jar
+jetty-plus-12.0.37.jar
+jetty-security-12.0.37.jar
+jetty-server-12.0.37.jar
shiro-cache-2.1.0.jar
shiro-crypto-cipher-2.1.0.jar
shiro-config-core-2.1.0.jar
shiro-event-2.1.0.jar
shiro-crypto-core-2.1.0.jar
shiro-lang-2.1.0.jar
-jetty-xml-12.0.33.jar
-jetty-http-12.0.33.jar
-jetty-io-12.0.33.jar
-jetty-jndi-12.0.33.jar
-jetty-util-12.0.33.jar
+jetty-xml-12.0.37.jar
+jetty-http-12.0.37.jar
+jetty-io-12.0.37.jar
+jetty-jndi-12.0.37.jar
+jetty-util-12.0.37.jar
spring-boot-starter-logging-3.3.13.jar
jul-to-slf4j-2.0.17.jar
slf4j-api-2.0.17.jar
@@ -122,9 +122,9 @@ micrometer-commons-1.15.12.jar
LatencyUtils-2.0.3.jar
snakeyaml-2.5.jar
spring-jcl-6.1.21.jar
-asm-commons-9.9.1.jar
-asm-tree-9.9.1.jar
-asm-9.9.1.jar
+asm-commons-9.10.1.jar
+asm-tree-9.10.1.jar
+asm-9.10.1.jar
txw2-4.0.2.jar
reactor-core-3.6.10.jar
jline-console-3.26.3.jar