Skip to content

Revert "[CVE Fixes] Update version of Nimbus.jose.jwt"#16986

Merged
abhishekagarwal87 merged 1 commit intoapache:masterfrom
pagrawal10:revert-16320-updateNimbus
Sep 9, 2024
Merged

Revert "[CVE Fixes] Update version of Nimbus.jose.jwt"#16986
abhishekagarwal87 merged 1 commit intoapache:masterfrom
pagrawal10:revert-16320-updateNimbus

Conversation

@pagrawal10
Copy link
Copy Markdown
Contributor

@pagrawal10 pagrawal10 commented Sep 2, 2024

Reverts #16320

Updating nimbus to version 9+ is causing HTTP ERROR 500 java.lang.NoSuchMethodError: 'net.minidev.json.JSONObject com.nimbusds.jwt.JWTClaimsSet.toJSONObject()'
Refer to https://github.com/SAP/cloud-security-services-integration-library/issues/429#issuecomment-1501601312 for more details.

We would need to upgrade other libraries as well for updating nimbus.jose.jwt

@cryptoe
Copy link
Copy Markdown
Contributor

cryptoe commented Sep 3, 2024

@pagrawal10 Whats other libraries need to get bumped up ?

@pagrawal10
Copy link
Copy Markdown
Contributor Author

We need to bump up druid-pac4j as well. I have created a PR for the same: #16567
We would need to add it as a different extension as that would not be compatible with JDK8.
pac4j versions > 5 are compatible with only JDK 11 and above
import needed is also different for pac4j v4.5.7 and pac4j v5.7.3 :
import org.pac4j.jee.context.JEEContext;
vs
import org.pac4j.core.context.JEEContext;

@abhishekagarwal87 abhishekagarwal87 added this to the 31.0.0 milestone Sep 3, 2024
@abhishekagarwal87 abhishekagarwal87 merged commit b7a21a9 into apache:master Sep 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants