-
Notifications
You must be signed in to change notification settings - Fork 57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgraded jetty version to fix a security vulnerability #1365
Conversation
Signed-off-by: Chandrakala Subramanyam <[email protected]>
pom.xml
Outdated
@@ -10,7 +10,7 @@ | |||
<properties> | |||
<fabric8-version>4.13.2</fabric8-version> | |||
<org-json-version>20240303</org-json-version> | |||
<jetty-version>9.4.55.v20240627</jetty-version> | |||
<jetty-version>9.4.56.v20240826</jetty-version> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we check with 12.0.15
as that is the latest?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With jetty 12.0.15 & 12.0.3 versions, I get the below error:
[ERROR] Failed to execute goal on project autotune: Could not resolve dependencies for project org.autotune:autotune:jar:0.1.1
[ERROR] dependency: org.eclipse.jetty:jetty-servlets:jar:12.0.15 (compile)
[ERROR] Could not find artifact org.eclipse.jetty:jetty-servlets:jar:12.0.15 in central (https://repo.maven.apache.org/maven2)
[ERROR] dependency: org.eclipse.jetty:jetty-servlet:jar:12.0.15 (compile)
[ERROR] Could not find artifact org.eclipse.jetty:jetty-servlet:jar:12.0.15 in central (https://repo.maven.apache.org/maven2)
Tried 11.0.24, but got the below compilation errors
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/experimentManager/handler/LoadValidationHandler.java:[32,21] package javax.servlet does not exist
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/experimentManager/handler/eminterface/EMHandlerInterface.java:[25,21] package javax.servlet does not exist
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/experimentManager/handler/LoadValidationHandler.java:[42,187] cannot find symbol
symbol: class ServletContext
location: class com.autotune.experimentManager.handler.LoadValidationHandler
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/experimentManager/handler/eminterface/EMHandlerInterface.java:[35,65] cannot find symbol
symbol: class ServletContext
location: interface com.autotune.experimentManager.handler.eminterface.EMHandlerInterface
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/analyzer/utils/AnalyzerErrorConstants.java:[25,26] package javax.servlet.http does not exist
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/analyzer/performanceProfiles/PerformanceProfileValidation.java:[33,26] package javax.servlet.http does not exist
[ERROR] /home/autotune/src/autotune/src/main/java/com/autotune/analyzer/services/ListExperiments.java:[49,21] package javax.servlet does not exist
Checking with 10.0.24
Signed-off-by: Chandrakala Subramanyam <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Description
Upgraded the jetty version to fix this vulnerability
Fixes # (issue)
Type of change
How has this been tested?
Tested this manually by building the docker image and pushing it to quay. Verified that this advisory is not listed by the quay security scanner
Test Configuration
Checklist 🎯
Additional information
Include any additional information such as links, test results, screenshots here