Upgrade jetty to 12.0.12 #2307
Upgrade jetty to 12.0.12 #2307
Conversation
There was a problem hiding this comment.
Hi @JvD-Ericsson, thanks for putting this together! It's a shame that CVE-2024-6763 wasn't patched for Jetty versions < v12.0.11 (and that Jetty versions 12 and above require Java 17+).
Although the Cruise Control codebase doesn't use the affected HttpURI class directly, the implementations of the methods that Cruise Control does use are affected. Since Cruise Control relies on Jetty pretty heavily and the Jetty versions < v12 are out of support, we should consider dropping support for Java 11 in favor of Java 17 so we can move the Cruise Control codebase to a supported version of Jetty.
We should leave this PR open and create a separate issue/PR to discuss dropping support for Java 11 for Cruise Control. After that is sorted, we can revisit addressing CVE-2024-6763.
1. Why: To remove CVEs: - CVE-2024-6763 - CVE-2024-13009 2. What: Upgrade jetty to 12.0.12 to remove CVE-2024-13009 and CVE-2024-6763, - [x] security/CVE Signed-off-by: JvD_Ericsson <[email protected]>
JvD-Ericsson
force-pushed
the
upgrade-jetty
branch
from
45760e4 to
765d76e
Compare
Summary
Why: To remove CVEs:
What: Upgrade jetty to 12.0.12 to remove CVE-2024-13009 and CVE-2024-6763
Jetty 12 only works with Java 17+ so, this change will not work with the Java 11