From 59f429e77f5802a7dc5ac129451a86247c6b86ad Mon Sep 17 00:00:00 2001 From: Damien Diederen Date: Mon, 8 Mar 2021 21:04:56 +0530 Subject: [PATCH] ZOOKEEPER-4233: dependency-check:check failing - Jetty 9.4.35.v20201120 - CVE-2020-27223 The OWASP checker reports that the version of Jetty currently referenced by this branch is vulnerable to a CVE: [ERROR] Failed to execute goal org.owasp:dependency-check-maven:5.3.0:check (default-cli) on project zookeeper: [ERROR] [ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '0.0': [ERROR] [ERROR] jetty-server-9.4.35.v20201120.jar: CVE-2020-27223 [ERROR] jetty-http-9.4.35.v20201120.jar: CVE-2020-27223 https://nvd.nist.gov/vuln/detail/CVE-2020-27223 describes it as: > In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), > 10.0.0, and 11.0.0 when Jetty handles a request containing multiple > Accept headers with a large number of "quality" (i.e. q) parameters, > the server may enter a denial of service (DoS) state due to high CPU > usage processing those quality values, resulting in minutes of CPU > time exhausted processing those quality values. This changeset bumps Jetty to 9.4.38.v20210224, which is the latest as of the commit date. Author: Damien Diederen Reviewers: Enrico Olivelli , Mohammad Arshad Closes #1625 from ztzg/ZOOKEEPER-4023-jetty-CVE-2020-27223-x-3.5 --- build.xml | 2 +- pom.xml | 2 +- ...1120.LICENSE.txt => jetty-http-9.4.38.v20210224.LICENSE.txt} | 0 ...201120.LICENSE.txt => jetty-io-9.4.38.v20210224.LICENSE.txt} | 0 ....LICENSE.txt => jetty-security-9.4.38.v20210224.LICENSE.txt} | 0 ...20.LICENSE.txt => jetty-server-9.4.38.v20210224.LICENSE.txt} | 0 ...0.LICENSE.txt => jetty-servlet-9.4.38.v20210224.LICENSE.txt} | 0 ...1120.LICENSE.txt => jetty-util-9.4.38.v20210224.LICENSE.txt} | 0 ...LICENSE.txt => jetty-util-ajax-9.4.38.v20210224.LICENSE.txt} | 0 9 files changed, 2 insertions(+), 2 deletions(-) rename zookeeper-server/src/main/resources/lib/{jetty-http-9.4.35.v20201120.LICENSE.txt => jetty-http-9.4.38.v20210224.LICENSE.txt} (100%) rename zookeeper-server/src/main/resources/lib/{jetty-io-9.4.35.v20201120.LICENSE.txt => jetty-io-9.4.38.v20210224.LICENSE.txt} (100%) rename zookeeper-server/src/main/resources/lib/{jetty-security-9.4.35.v20201120.LICENSE.txt => jetty-security-9.4.38.v20210224.LICENSE.txt} (100%) rename zookeeper-server/src/main/resources/lib/{jetty-server-9.4.35.v20201120.LICENSE.txt => jetty-server-9.4.38.v20210224.LICENSE.txt} (100%) rename zookeeper-server/src/main/resources/lib/{jetty-servlet-9.4.35.v20201120.LICENSE.txt => jetty-servlet-9.4.38.v20210224.LICENSE.txt} (100%) rename zookeeper-server/src/main/resources/lib/{jetty-util-9.4.35.v20201120.LICENSE.txt => jetty-util-9.4.38.v20210224.LICENSE.txt} (100%) rename zookeeper-server/src/main/resources/lib/{jetty-util-ajax-9.4.35.v20201120.LICENSE.txt => jetty-util-ajax-9.4.38.v20210224.LICENSE.txt} (100%) diff --git a/build.xml b/build.xml index 41f2ee32a87..dad6a6dded4 100644 --- a/build.xml +++ b/build.xml @@ -54,7 +54,7 @@ xmlns:cs="antlib:com.puppycrawl.tools.checkstyle.ant"> - + diff --git a/pom.xml b/pom.xml index f140a041503..1ee6692a202 100755 --- a/pom.xml +++ b/pom.xml @@ -297,7 +297,7 @@ 2.27.0 1.3 1.2 - 9.4.35.v20201120 + 9.4.38.v20210224 4.1.59.Final 2.10.5.1 1.1.1 diff --git a/zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-http-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-http-9.4.38.v20210224.LICENSE.txt diff --git a/zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-io-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-io-9.4.38.v20210224.LICENSE.txt diff --git a/zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-security-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-security-9.4.38.v20210224.LICENSE.txt diff --git a/zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-server-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-server-9.4.38.v20210224.LICENSE.txt diff --git a/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.38.v20210224.LICENSE.txt diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-util-9.4.38.v20210224.LICENSE.txt diff --git a/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt b/zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.38.v20210224.LICENSE.txt similarity index 100% rename from zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt rename to zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.38.v20210224.LICENSE.txt