[kafka] branch 2.6 updated: KAFKA-12324: Upgrade jetty to fix CVE-2020-27218

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

manikumar pushed a commit to branch 2.6
in repository https://gitbox.apache.org/repos/asf/kafka.git


The following commit(s) were added to refs/heads/2.6 by this push:
     new 24a9ec2  KAFKA-12324: Upgrade jetty to fix CVE-2020-27218
24a9ec2 is described below

commit 24a9ec2ef3a7ad36119a0b94835fe2fdc8534d0e
Author: Lee Dongjin <do...@apache.org>
AuthorDate: Mon Feb 22 23:19:06 2021 +0530

    KAFKA-12324: Upgrade jetty to fix CVE-2020-27218
    
    Here is the fix. The reason of [CVE-2020-27218](https://nvd.nist.gov/vuln/detail/CVE-2020-27218) was [Incorrect recycling of `HttpInput`](https://bugs.eclipse.org/bugs/show_bug.cgi?id=568892) and [patched in 9.4.35.v20201120](https://github.com/eclipse/jetty.project/security/advisories/GHSA-86wm-rrjm-8wh8).
    
    This PR updates Jetty dependency into the following version, 9.4.36.v20210114.
    
    Author: Lee Dongjin <do...@apache.org>
    
    Reviewers: Manikumar Reddy <ma...@gmail.com>
    
    Closes #10177 from dongjinleekr/feature/KAFKA-12324
    
    (cherry picked from commit c71ec552d100973cda65da3228ba3f2ab8039221)
    Signed-off-by: Manikumar Reddy <ma...@gmail.com>
---
 gradle/dependencies.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index 20aecff..d1b1786 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -69,7 +69,7 @@ versions += [
   jackson: "2.10.5",
   jacksonDatabind: "2.10.5.1",
   jacoco: "0.8.5",
-  jetty: "9.4.33.v20201020",
+  jetty: "9.4.36.v20210114",
   jersey: "2.31",
   jmh: "1.23",
   hamcrest: "2.2",