Skip to content

KAFKA-14107: Upgrade Jetty version for CVE fixes#12440

Merged
mimaison merged 1 commit intoapache:trunkfrom
ajborley:update-jetty-to-9.4.48
Aug 5, 2022
Merged

KAFKA-14107: Upgrade Jetty version for CVE fixes#12440
mimaison merged 1 commit intoapache:trunkfrom
ajborley:update-jetty-to-9.4.48

Conversation

@ajborley
Copy link
Copy Markdown
Contributor

@ajborley ajborley commented Jul 26, 2022

KAFKA-14107 Upgrade Jetty for CVE fixes.

Jetty: CVE-2022-2048
and CVE-2022-2047

  • Fixed by upgrading to 9.4.48.v20220622

Signed-off-by: Andrew Borley BORLEY@uk.ibm.com

@ajborley
KAFKA-14107: Upgrade Jetty version for CVE fixes
0193be8 
KAFKA-14107 Upgrade Jetty for CVE fixes.

Jetty: [CVE-2022-2048](https://nvd.nist.gov/vuln/detail/CVE-2022-2048)
and [CVE-2022-2047](https://nvd.nist.gov/vuln/detail/CVE-2022-2047)
- Fixed by upgrading to 9.4.48.v20220622

Signed-off-by: Andrew Borley <BORLEY@uk.ibm.com>
@jsancio jsancio added the 3.3 label Aug 5, 2022
@afreeland
Copy link
Copy Markdown

afreeland commented Aug 5, 2022 •
edited
Loading

Would love to see this get merged in, seen this failing in our container scans as well. Originally thought it was something in our base image and then discovered it was Kafka. It appears to be in 3.2 and 3.3 just from a quick check...I am using 3.2 when I initially noticed this.

Honestly, not very familiar with jetty but is it currently possible to upgrade the jetty-io package independently for existing containers?

mimaison
mimaison approved these changes Aug 5, 2022
View reviewed changes
Copy link
Copy Markdown
Member

@mimaison mimaison left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, LGTM

@mimaison
Copy link
Copy Markdown
Member

mimaison commented Aug 5, 2022

I believe Kafka may only be affected by CVE-2022-2047. CVE-2022-2048 is an issue in http2-server which is not used by Kafka.

@mimaison mimaison merged commit fdc19fb into apache:trunk Aug 5, 2022
mimaison pushed a commit that referenced this pull request Aug 5, 2022
@ajborley @mimaison
KAFKA-14107: Upgrade Jetty version for CVE fixes (#12440)
eed9192 
Reviewers: Mickael Maison <mickael.maison@gmail.com>, Aaron Freeland <afreeland@gmail.com>
mimaison pushed a commit that referenced this pull request Aug 5, 2022
@ajborley @mimaison
KAFKA-14107: Upgrade Jetty version for CVE fixes (#12440)
fa369e7 
Reviewers: Mickael Maison <mickael.maison@gmail.com>, Aaron Freeland <afreeland@gmail.com>
mimaison pushed a commit that referenced this pull request Aug 5, 2022
@ajborley @mimaison
KAFKA-14107: Upgrade Jetty version for CVE fixes (#12440)
f5d3649 
Reviewers: Mickael Maison <mickael.maison@gmail.com>, Aaron Freeland <afreeland@gmail.com>
mimaison pushed a commit that referenced this pull request Aug 5, 2022
@ajborley @mimaison
KAFKA-14107: Upgrade Jetty version for CVE fixes (#12440)
1c6d354 
Reviewers: Mickael Maison <mickael.maison@gmail.com>, Aaron Freeland <afreeland@gmail.com>
mimaison pushed a commit that referenced this pull request Aug 5, 2022
@ajborley @mimaison
KAFKA-14107: Upgrade Jetty version for CVE fixes (#12440)
cd03215 
Reviewers: Mickael Maison <mickael.maison@gmail.com>, Aaron Freeland <afreeland@gmail.com>
@mimaison
Copy link
Copy Markdown
Member

mimaison commented Aug 5, 2022

Backported to 3.3, 3.2, 3.1, 3.0 and 2.8.

ijuma added a commit to confluentinc/kafka that referenced this pull request Aug 10, 2022
@ijuma
CONFLUENT: Sync from apache/kafka trunk to confluentinc/kafka master …
1f27eb1 
…(10 August 2022)

Trivial conflict in gradle/dependencies.gradle due to the newer Netty
version in confluentinc/kafka.

* apache-github/trunk:
MINOR: Upgrade gradle to 7.5.1 and bump other build/test dependencies
(apache#12495)
KAFKA-14140: Ensure an offline or in-controlled-shutdown replica is
not eligible to join ISR in ZK mode (apache#12487)
  KAFKA-14114: Add Metadata Error Related Metrics
MINOR: BrokerMetadataSnapshotter must avoid exceeding batch size
(apache#12486)
  MINOR: Upgrade mockito test dependencies (apache#12460)
KAFKA-14144:; Compare AlterPartition LeaderAndIsr before fencing
partition epoch (apache#12489)
KAFKA-14134: Replace EasyMock with Mockito for WorkerConnectorTest
(apache#12472)
  MINOR: Update scala version in bin scripts to 2.13.8 (apache#12477)
KAFKA-14104; Add CRC validation when iterating over Metadata Log
Records (apache#12457)
  MINOR: add :server-common test dependency to :storage (apache#12488)
  KAFKA-14107: Upgrade Jetty version for CVE fixes (apache#12440)
  KAFKA-14124: improve quorum controller fault handling (apache#12447)
ijuma added a commit to franz1981/kafka that referenced this pull request Aug 12, 2022
@ijuma
Merge remote-tracking branch 'apache-github/trunk' into KAFKA-13900
9a644f1 
* apache-github/trunk: (447 commits)
  KAFKA-13959: Controller should unfence Broker with busy metadata log (apache#12274)
  KAFKA-10199: Expose read only task from state updater (apache#12497)
  KAFKA-14154; Return NOT_CONTROLLER from AlterPartition if leader is ahead of controller (apache#12506)
  KAFKA-13986; Brokers should include node.id in fetches to metadata quorum (apache#12498)
  KAFKA-14163; Retry compilation after zinc compile cache error (apache#12507)
  Remove duplicate common.message.* from clients:test jar file (apache#12407)
  KAFKA-13060: Replace EasyMock and PowerMock with Mockito in WorkerGroupMemberTest.java (apache#12484)
  Fix the rate window size calculation for edge cases (apache#12184)
  MINOR: Upgrade gradle to 7.5.1 and bump other build/test dependencies (apache#12495)
  KAFKA-14140: Ensure an offline or in-controlled-shutdown replica is not eligible to join ISR in ZK mode (apache#12487)
  KAFKA-14114: Add Metadata Error Related Metrics
  MINOR: BrokerMetadataSnapshotter must avoid exceeding batch size (apache#12486)
  MINOR: Upgrade mockito test dependencies (apache#12460)
  KAFKA-14144:; Compare AlterPartition LeaderAndIsr before fencing partition epoch (apache#12489)
  KAFKA-14134: Replace EasyMock with Mockito for WorkerConnectorTest (apache#12472)
  MINOR: Update scala version in bin scripts to 2.13.8 (apache#12477)
  KAFKA-14104; Add CRC validation when iterating over Metadata Log Records (apache#12457)
  MINOR: add :server-common test dependency to :storage (apache#12488)
  KAFKA-14107: Upgrade Jetty version for CVE fixes (apache#12440)
  KAFKA-14124: improve quorum controller fault handling (apache#12447)
  ...
@ajborley ajborley deleted the update-jetty-to-9.4.48 branch September 6, 2022 20:35
fmin added a commit to confluentinc/kafka that referenced this pull request Sep 14, 2022
@fmin
Merge remote-tracking branch 'apache-kafka/2.8' into sync-2.8-14-Sep-…
37565bb 
…2022

* apache-kafka/2.8:
  MINOR: Update 2.8 branch version to 2.8.3-SNAPSHOT
  MINOR: Update NOTICE file
  MINOR: Update version to 2.8.2
  MINOR: Bump version in upgrade guide to 2.8.2
  MINOR: Update LICENSE for 2.8.2
  MINOR: Disable kraft system tests in 2.8 branch
  MINOR: Add configurable max receive size for SASL authentication requests
  MINOR: Add more validation during KRPC deserialization
  KAFKA-14107: Upgrade Jetty version for CVE fixes (apache#12440)
@fmin fmin mentioned this pull request Sep 14, 2022
Merged
fmin added a commit to confluentinc/kafka that referenced this pull request Sep 14, 2022
@fmin
Merge remote-tracking branch 'apache-kafka/3.1' into sync-upstream-3.…
44e83d1 
…1-14-SEP-2022

* apache-kafka/3.1: (17 commits)
  MINOR: Update 3.1 branch version to 3.1.3-SNAPSHOT
  Upgrade Netty and Jackson versions for CVE fixes [KAFKA-14044] (apache#12376)
  Bump version to 3.1.2
  MINOR: Update LICENSE-binary
  MINOR: Bump version in upgrade guide to 3.1.2
  MINOR: Add configurable max receive size for SASL authentication requests
  MINOR: Add more validation during KRPC deserialization
  MINOR: Add note on IDEMPOTENT_WRITE ACL to notable changes (apache#12260)
  KAFKA-14107: Upgrade Jetty version for CVE fixes (apache#12440)
  KAFKA-14062: OAuth client token refresh fails with SASL extensions (apache#12398)
  ...
@pranayk01
Copy link
Copy Markdown

pranayk01 commented Sep 26, 2022

Hi, is this the fix for CVE-2022-34917 as well?

@ajborley
Copy link
Copy Markdown
Contributor Author

ajborley commented Sep 26, 2022

No, this is just a dependency update. The fix must have been in either #12603 or #12626 as those are the only changes between 3.2.2 and 3.2.3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mimaison mimaison mimaison approved these changes

+1 more reviewer

@afreeland afreeland afreeland approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@ajborley @afreeland @mimaison @pranayk01 @jsancio