Downgrade jetty package #478

shubh-ranade · 2024-04-01T19:57:59Z

Downgrade jetty to 9.4.53

Commons jetty version was upgraded to 9.4.54 recently: confluentinc/common#582 which affects userId/tenant based DoS filters in this repo.

Dependencies after the downgrade:

❯ mvn dependency:tree -Dincludes=org.eclipse.jetty
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Detecting the operating system and CPU architecture
[INFO] ------------------------------------------------------------------------
[INFO] os.detected.name: osx
[INFO] os.detected.arch: aarch_64
[INFO] os.detected.bitness: 64
[INFO] os.detected.version: 14.3
[INFO] os.detected.version.major: 14
[INFO] os.detected.version.minor: 3
[INFO] os.detected.classifier: osx-aarch_64
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] rest-utils-parent                                                  [pom]
[INFO] rest-utils                                                         [jar]
[INFO] rest-utils-test                                                    [jar]
[INFO] rest-utils-example                                                 [jar]
[INFO] rest-utils-package                                                 [pom]
[INFO] rest-utils-fips-tests                                              [jar]
[INFO]
[INFO] -------------------< io.confluent:rest-utils-parent >-------------------
[INFO] Building rest-utils-parent 7.8.0-0                                 [1/6]
[INFO]   from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency:3.3.0:tree (default-cli) @ rest-utils-parent ---
[INFO]
[INFO] ----------------------< io.confluent:rest-utils >-----------------------
[INFO] Building rest-utils 7.8.0-0                                        [2/6]
[INFO]   from core/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- dependency:3.3.0:tree (default-cli) @ rest-utils ---
[INFO] io.confluent:rest-utils:jar:7.8.0-0
[INFO] +- org.eclipse.jetty.websocket:javax-websocket-server-impl:jar:9.4.53.v20231009:compile
[INFO] |  \- org.eclipse.jetty:jetty-annotations:jar:9.4.53.v20231009:compile
[INFO] |     +- org.eclipse.jetty:jetty-plus:jar:9.4.53.v20231009:compile
[INFO] |     |  \- org.eclipse.jetty:jetty-jndi:jar:9.4.53.v20231009:compile
[INFO] |     \- org.eclipse.jetty:jetty-webapp:jar:9.4.53.v20231009:compile
[INFO] |        \- org.eclipse.jetty:jetty-xml:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-jmx:jar:9.4.53.v20231009:compile
[INFO] |  \- org.eclipse.jetty:jetty-util:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-server:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-http:jar:9.4.53.v20231009:compile
[INFO] |  \- org.eclipse.jetty:jetty-io:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-alpn-server:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-alpn-java-server:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-alpn-conscrypt-server:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-servlet:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-security:jar:9.4.53.v20231009:compile
[INFO] |  \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-servlets:jar:9.4.53.v20231009:compile
[INFO] |  \- org.eclipse.jetty:jetty-continuation:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-jaas:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty.http2:http2-client:jar:9.4.53.v20231009:test
[INFO] |  \- org.eclipse.jetty:jetty-alpn-client:jar:9.4.53.v20231009:test
[INFO] \- org.eclipse.jetty.http2:http2-http-client-transport:jar:9.4.53.v20231009:test
[INFO]    +- org.eclipse.jetty:jetty-client:jar:9.4.53.v20231009:compile
[INFO]    \- org.eclipse.jetty:jetty-alpn-java-client:jar:9.4.53.v20231009:test
[INFO]
[INFO] --------------------< io.confluent:rest-utils-test >--------------------
[INFO] Building rest-utils-test 7.8.0-0                                   [3/6]
[INFO]   from test/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- dependency:3.3.0:tree (default-cli) @ rest-utils-test ---
[INFO] io.confluent:rest-utils-test:jar:7.8.0-0
[INFO] \- io.confluent:rest-utils:jar:7.8.0-0:compile
[INFO]    +- org.eclipse.jetty.websocket:javax-websocket-server-impl:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-annotations:jar:9.4.53.v20231009:compile
[INFO]    |  |  +- org.eclipse.jetty:jetty-plus:jar:9.4.53.v20231009:compile
[INFO]    |  |  |  \- org.eclipse.jetty:jetty-jndi:jar:9.4.53.v20231009:compile
[INFO]    |  |  \- org.eclipse.jetty:jetty-webapp:jar:9.4.53.v20231009:compile
[INFO]    |  |     \- org.eclipse.jetty:jetty-xml:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty.websocket:javax-websocket-client-impl:jar:9.4.53.v20231009:compile
[INFO]    |     \- org.eclipse.jetty.websocket:websocket-client:jar:9.4.53.v20231009:compile
[INFO]    |        \- org.eclipse.jetty:jetty-client:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-jmx:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-server:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-http:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-io:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-java-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-conscrypt-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-servlet:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-security:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-servlets:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-continuation:jar:9.4.53.v20231009:compile
[INFO]    \- org.eclipse.jetty:jetty-jaas:jar:9.4.53.v20231009:compile
[INFO]
[INFO] ------------------< io.confluent:rest-utils-examples >------------------
[INFO] Building rest-utils-example 7.8.0-0                                [4/6]
[INFO]   from examples/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- dependency:3.3.0:tree (default-cli) @ rest-utils-examples ---
[INFO] io.confluent:rest-utils-examples:jar:7.8.0-0
[INFO] \- io.confluent:rest-utils:jar:7.8.0-0:compile
[INFO]    +- org.eclipse.jetty.websocket:javax-websocket-server-impl:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-annotations:jar:9.4.53.v20231009:compile
[INFO]    |  |  +- org.eclipse.jetty:jetty-plus:jar:9.4.53.v20231009:compile
[INFO]    |  |  |  \- org.eclipse.jetty:jetty-jndi:jar:9.4.53.v20231009:compile
[INFO]    |  |  \- org.eclipse.jetty:jetty-webapp:jar:9.4.53.v20231009:compile
[INFO]    |  |     \- org.eclipse.jetty:jetty-xml:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty.websocket:javax-websocket-client-impl:jar:9.4.53.v20231009:compile
[INFO]    |     \- org.eclipse.jetty.websocket:websocket-client:jar:9.4.53.v20231009:compile
[INFO]    |        \- org.eclipse.jetty:jetty-client:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-jmx:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-server:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-http:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-io:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-java-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-conscrypt-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-servlet:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-security:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-servlets:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-continuation:jar:9.4.53.v20231009:compile
[INFO]    \- org.eclipse.jetty:jetty-jaas:jar:9.4.53.v20231009:compile
[INFO]
[INFO] ------------------< io.confluent:rest-utils-package >-------------------
[INFO] Building rest-utils-package 7.8.0-0                                [5/6]
[INFO]   from package/pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- dependency:3.3.0:tree (default-cli) @ rest-utils-package ---
[INFO] io.confluent:rest-utils-package:pom:7.8.0-0
[INFO] \- io.confluent:rest-utils:jar:7.8.0-0:compile
[INFO]    +- org.eclipse.jetty.websocket:javax-websocket-server-impl:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-annotations:jar:9.4.53.v20231009:compile
[INFO]    |  |  +- org.eclipse.jetty:jetty-plus:jar:9.4.53.v20231009:compile
[INFO]    |  |  |  \- org.eclipse.jetty:jetty-jndi:jar:9.4.53.v20231009:compile
[INFO]    |  |  \- org.eclipse.jetty:jetty-webapp:jar:9.4.53.v20231009:compile
[INFO]    |  |     \- org.eclipse.jetty:jetty-xml:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty.websocket:javax-websocket-client-impl:jar:9.4.53.v20231009:compile
[INFO]    |     \- org.eclipse.jetty.websocket:websocket-client:jar:9.4.53.v20231009:compile
[INFO]    |        \- org.eclipse.jetty:jetty-client:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-jmx:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-server:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-http:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-io:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-java-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-alpn-conscrypt-server:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-servlet:jar:9.4.53.v20231009:compile
[INFO]    |  +- org.eclipse.jetty:jetty-security:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.53.v20231009:compile
[INFO]    +- org.eclipse.jetty:jetty-servlets:jar:9.4.53.v20231009:compile
[INFO]    |  \- org.eclipse.jetty:jetty-continuation:jar:9.4.53.v20231009:compile
[INFO]    \- org.eclipse.jetty:jetty-jaas:jar:9.4.53.v20231009:compile
[INFO]
[INFO] -----------------< io.confluent:rest-utils-fips-tests >-----------------
[INFO] Building rest-utils-fips-tests 7.8.0-0                             [6/6]
[INFO]   from fips-tests/pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- dependency:3.3.0:tree (default-cli) @ rest-utils-fips-tests ---
[INFO] io.confluent:rest-utils-fips-tests:jar:7.8.0-0
[INFO] +- io.confluent:rest-utils:jar:7.8.0-0:compile
[INFO] |  +- org.eclipse.jetty.websocket:javax-websocket-server-impl:jar:9.4.53.v20231009:compile
[INFO] |  |  \- org.eclipse.jetty:jetty-annotations:jar:9.4.53.v20231009:compile
[INFO] |  |     +- org.eclipse.jetty:jetty-plus:jar:9.4.53.v20231009:compile
[INFO] |  |     |  \- org.eclipse.jetty:jetty-jndi:jar:9.4.53.v20231009:compile
[INFO] |  |     \- org.eclipse.jetty:jetty-webapp:jar:9.4.53.v20231009:compile
[INFO] |  |        \- org.eclipse.jetty:jetty-xml:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-jmx:jar:9.4.53.v20231009:compile
[INFO] |  |  \- org.eclipse.jetty:jetty-util:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-server:jar:9.4.53.v20231009:compile
[INFO] |  |  \- org.eclipse.jetty:jetty-http:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-alpn-server:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-alpn-conscrypt-server:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-servlet:jar:9.4.53.v20231009:compile
[INFO] |  |  +- org.eclipse.jetty:jetty-security:jar:9.4.53.v20231009:compile
[INFO] |  |  \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.53.v20231009:compile
[INFO] |  +- org.eclipse.jetty:jetty-servlets:jar:9.4.53.v20231009:compile
[INFO] |  |  \- org.eclipse.jetty:jetty-continuation:jar:9.4.53.v20231009:compile
[INFO] |  \- org.eclipse.jetty:jetty-jaas:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-alpn-java-server:jar:9.4.53.v20231009:test
[INFO] |  \- org.eclipse.jetty:jetty-io:jar:9.4.53.v20231009:compile
[INFO] +- org.eclipse.jetty:jetty-alpn-java-client:jar:9.4.53.v20231009:test
[INFO] |  \- org.eclipse.jetty:jetty-alpn-client:jar:9.4.53.v20231009:test
[INFO] \- org.eclipse.jetty.http2:http2-http-client-transport:jar:9.4.53.v20231009:test
[INFO]    \- org.eclipse.jetty:jetty-client:jar:9.4.53.v20231009:compile
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for rest-utils-parent 7.8.0-0:
[INFO]
[INFO] rest-utils-parent .................................. SUCCESS [  0.410 s]
[INFO] rest-utils ......................................... SUCCESS [  0.266 s]
[INFO] rest-utils-test .................................... SUCCESS [  0.022 s]
[INFO] rest-utils-example ................................. SUCCESS [  0.014 s]
[INFO] rest-utils-package ................................. SUCCESS [  0.011 s]
[INFO] rest-utils-fips-tests .............................. SUCCESS [  0.021 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  1.111 s
[INFO] Finished at: 2024-04-01T15:57:13-04:00
[INFO] ------------------------------------------------------------------------

cla-assistant · 2024-04-01T19:58:14Z

All committers have signed the CLA.

cla-assistant · 2024-04-01T19:58:16Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

janjwerner-confluent · 2024-04-01T21:18:24Z

Could you
add

org.eclipse.jetty
jetty-servlets
9.4.53.v20231009

to dependency management section instead rather than downgrading jetty server and exposing it to CVE-2023-36478

Downgrade jetty

2897c0d

shubh-ranade requested review from a team as code owners April 1, 2024 19:58

shubh-ranade mentioned this pull request Apr 1, 2024

Downgrade jetty package confluentinc/common#590

Closed

ehumber approved these changes Apr 1, 2024

View reviewed changes

shubh-ranade merged commit e982145 into master Apr 1, 2024

shubh-ranade deleted the sranade/downgrade-jetty-dos-protection branch April 1, 2024 20:54

shubh-ranade mentioned this pull request Apr 1, 2024

Downgrade jetty-servlets package #479

Merged

trnguyencflt mentioned this pull request Oct 28, 2024

bump: jetty servlets version #505

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Downgrade jetty package #478

Downgrade jetty package #478

Uh oh!

shubh-ranade commented Apr 1, 2024 •

edited

Loading

Uh oh!

cla-assistant bot commented Apr 1, 2024 •

edited

Loading

Uh oh!

cla-assistant bot commented Apr 1, 2024

Uh oh!

janjwerner-confluent commented Apr 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Downgrade jetty package #478

Downgrade jetty package #478

Uh oh!

Conversation

shubh-ranade commented Apr 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cla-assistant bot commented Apr 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cla-assistant bot commented Apr 1, 2024

Uh oh!

janjwerner-confluent commented Apr 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shubh-ranade commented Apr 1, 2024 •

edited

Loading

cla-assistant bot commented Apr 1, 2024 •

edited

Loading