[SPARK-39725][BUILD] Upgrade jetty-http from 9.4.46.v20220331 to 9.4.48.v20220622
#37142
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bjornjorgensen
changed the title
jetty-http from 9.4.46.v20220331 to 9.4.48.v20220622
bjornjorgensen
changed the title
jetty-http from 9.4.46.v20220331 to 9.4.48.v20220622jetty-http from 9.4.46.v20220331 to 9.4.48.v20220622
|
Note: Jetty 9.4.x is now at End of Community Support. We can't upgrade to Jetty 10.x because we are using java 8. |
HyukjinKwon
approved these changes
Jul 8, 2022
|
Merged to master. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Upgrade
jetty-httpfrom 9.4.46.v20220331 to 9.4.48.v20220622Why are the changes needed?
Release note
CVE-2022-2047
Info from Github dependabot
Invalid URI parsing may produce invalid HttpURI.authority
Description
URI use within Jetty's
HttpURIclass can parse invalid URIs such ashttp://localhost;/pathas having an authority with a host oflocalhost;.A URIs of the type
http://localhost;/pathshould be interpreted to be either invalid or aslocalhost;to be the userinfo and no host.However,
HttpURI.hostreturnslocalhost;which is definitely wrong.Impact
This can lead to errors with Jetty's
HttpClient, and Jetty'sProxyServlet/AsyncProxyServlet/AsyncMiddleManServletwrongly interpreting an authority with no host as one with a host.Patches
Patched in PR jetty/jetty.project#8146 for Jetty version 9.4.47.
Patched in PR jetty/jetty.project#8015 for Jetty versions 10.0.10, and 11.0.10
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
Email us at security@webtide.com."
Does this PR introduce any user-facing change?
No.
How was this patch tested?
Pass GA