You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by GitBox <gi...@apache.org> on 2020/11/04 18:24:48 UTC

[GitHub] [kafka] niteshmor opened a new pull request #9556: MINOR: Update jetty to 9.4.33

niteshmor opened a new pull request #9556:
URL: https://github.com/apache/kafka/pull/9556


   Jetty 9.4.32 and before are affected by CVE-2020-27216. This vulnerability is fixed in Jetty 9.4.33, please see the jetty project security advisory for details: https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053
   
   Unit tests and integration tests pass locally after the upgrade.
   
   ### Committer Checklist (excluded from commit message)
   - [ ] Verify design and implementation 
   - [ ] Verify test coverage and CI build status
   - [ ] Verify documentation (including upgrade notes)
   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] niteshmor edited a comment on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

niteshmor edited a comment on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-721898016

For applying this fix to older branches, this commit can be cherry-picked to
`2.7` branch. For branches `2.6` and earlier, `jersey` version also needs to be
upgraded to `2.31` based on the following note in `2.5` and `2.6` branches
that are on jetty `9.4.24`: https://github.com/apache/kafka/blob/2.6/gradle/dependencies.gradle#L71

For validating that this change can be backported, I have prepared commits in
my own fork for older branches going back till 2.4 and ran the tests locally.
Note that I only used Java 11 in my local testing.
To assist in applying the fix to older branches, these can serve as a reference
for what the exact change is. Or I can create new pull requests to the older
branches if that's easier.

- For 2.7, unit/integration tests pass locally. Reference commit: https://github.com/niteshmor/kafka/commit/8b51bd18f4541d1edb7d423a01314f78f1988fe8
- For 2.6, 2 tests failed locally, but I believe they are unrelated. The failed tests are:
- `SslAdminIntegrationTest.testCreateTopicsResponseMetadataAndConfig`
- `ReplicaManagerTest.testFencedErrorCausedByBecomeLeader`
Reference commit: https://github.com/niteshmor/kafka/commit/a0d3dc0f2e490d04b324ad72c47cd1363cc9dd6c
- For 2.5, unit/integration tests pass locally. Reference commit: https://github.com/niteshmor/kafka/commit/f8f68c334132dd293d96d5be1a1c3d307896cefa
- For 2.4, unit/integration tests pass locally. Reference commit: https://github.com/niteshmor/kafka/commit/9c08944c3c793c7733e0971a68dcb580dd4c288f

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] omkreddy commented on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

omkreddy commented on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-724131363


   Merging to trunk and older branches.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] niteshmor commented on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

niteshmor commented on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-724139651


   Thanks @omkreddy 
   For older releases, feel free to use the commits noted in https://github.com/apache/kafka/pull/9556#issuecomment-721898016 as a reference. Git cherry-picking didn't work for me, and older versions required jersey upgrade anyways. 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] omkreddy closed pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

omkreddy closed pull request #9556:
URL: https://github.com/apache/kafka/pull/9556


   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] omkreddy edited a comment on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

omkreddy edited a comment on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-724131363


   Merging to trunk and older branches (2.7, 2.6, 2.5, 2.4)


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] niteshmor commented on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

niteshmor commented on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-721900447


   cc @ijuma @kkonstantine @rhauch @C0urante 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] niteshmor commented on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

niteshmor commented on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-721898016

For validating that this change can be backported, I have prepared commits in
my own fork for older branches going back till 2.4 and ran the tests locally.
To assist in applying the fix to older branches, these can serve as a reference
for what the exact change is. Or I can create new pull requests to the older
branches if that's easier.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [kafka] niteshmor commented on pull request #9556: MINOR: Update jetty to 9.4.33

Posted by GitBox <gi...@apache.org>.

niteshmor commented on pull request #9556:
URL: https://github.com/apache/kafka/pull/9556#issuecomment-721998495


   Test failure seems to be unrelated. 
   
   `java.nio.file.DirectoryNotEmptyException` in `org.apache.kafka.streams.integration.StreamTableJoinTopologyOptimizationIntegrationTest`


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org