Skip to content

Commit

Permalink
[SPARK-37934][BUILD][3.2] Upgrade Jetty version to 9.4.44
Browse files Browse the repository at this point in the history
### What changes were proposed in this pull request?

This pull request updates provides a minor update to the Jetty version from `9.4.43.v20210629` to `9.4.44.v20210927` which is required against branch-3.2 to fully resolve https://issues.apache.org/jira/browse/SPARK-37934

### Why are the changes needed?

As discussed in #35338, DoS vector is available even within a private or restricted network. The below result is the output of a twistlock scan, which also detects this vulnerability.

```
Source: jetty/jetty.project#6973
CVE: PRISMA-2021-0182
Sev.: medium
Package Name: org.eclipse.jetty_jetty-server
Package Ver.: 9.4.43.v20210629
Status: fixed in 9.4.44
Description: org.eclipse.jetty_jetty-server package versions before 9.4.44 are vulnerable to DoS (Denial of Service). Logback-access calls Request.getParameterNames() for request logging. That will force a request body read (if it hasn't been read before) per the servlet. This will now consume resources to read the request body content, which could easily be malicious (in size? in keys? etc), even though the application intentionally didn't read the request body.
```

### Does this PR introduce _any_ user-facing change?

No.

### How was this patch tested?

* Core local
```
$ build/sbt
> project core
> test
```
* CI

Closes #35442 from JackBuggins/branch-3.2.

Authored-by: Jack Richard Buggins <[email protected]>
Signed-off-by: Kousuke Saruta <[email protected]>
  • Loading branch information
JackBuggins authored and sarutak committed Feb 8, 2022
1 parent 34c474a commit adba516
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@
<derby.version>10.14.2.0</derby.version>
<parquet.version>1.12.2</parquet.version>
<orc.version>1.6.13</orc.version>
<jetty.version>9.4.43.v20210629</jetty.version>
<jetty.version>9.4.44.v20210927</jetty.version>
<jakartaservlet.version>4.0.3</jakartaservlet.version>
<chill.version>0.10.0</chill.version>
<ivy.version>2.5.0</ivy.version>
Expand Down

0 comments on commit adba516

Please sign in to comment.