You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "mike-lloyd03 (via GitHub)" <gi...@apache.org> on 2024/01/29 19:40:58 UTC
[PR] Update jose4j to 0.9.4 to address CVE-2023-51775 [kafka]
mike-lloyd03 opened a new pull request, #15284:
URL: https://github.com/apache/kafka/pull/15284
*More detailed description of your change,
if necessary. The PR title and PR message become
the squashed commit message, so use a separate
comment to ping reviewers.*
*Summary of testing strategy (including rationale)
for the feature or bug fix. Unit and/or integration
tests are expected for any behaviour change and
system tests should be considered for larger changes.*
### Committer Checklist (excluded from commit message)
- [ ] Verify design and implementation
- [ ] Verify test coverage and CI build status
- [ ] Verify documentation (including upgrade notes)
`org.bitbucket.b_c:jose4j` 0.9.3 is susceptible to Denial of Service per [CVE-2023-51775](https://www.cve.org/CVERecord?id=CVE-2023-51775).
This PR updates `kafka` to use 0.9.4.
Thank you
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16210: Update jose4j to 0.9.4 [kafka]
Posted by "divijvaidya (via GitHub)" <gi...@apache.org>.
divijvaidya merged PR #15284:
URL: https://github.com/apache/kafka/pull/15284
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16210: Update jose4j to 0.9.4 [kafka]
Posted by "divijvaidya (via GitHub)" <gi...@apache.org>.
divijvaidya commented on PR #15284:
URL: https://github.com/apache/kafka/pull/15284#issuecomment-1916513162
the CI tests that are failing are unrelated since they don't use SASL (which is impacted by this dependency)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KAFKA-16210: Update jose4j to 0.9.4 [kafka]
Posted by "divijvaidya (via GitHub)" <gi...@apache.org>.
divijvaidya commented on PR #15284:
URL: https://github.com/apache/kafka/pull/15284#issuecomment-1916524273
backported to 3.7
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org