[fix][sec] Upgrade Jetty to 9.4.57.v20241219 to mitigate CVE-2024-6763 #24232
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
3 tasks
Member
|
hello , I am a new developer for pulsar, our product start to use pulsar, which replace kafka in serverless env. I can learn your pr. our other product has upgraded jetty to 9.4.57.v20241219. this pr is good. |
nodece
approved these changes
Apr 30, 2025
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #24232 +/- ##
============================================
+ Coverage 73.57% 74.19% +0.62%
+ Complexity 32624 32557 -67
============================================
Files 1877 1866 -11
Lines 139502 144900 +5398
Branches 15299 16549 +1250
============================================
+ Hits 102638 107515 +4877
+ Misses 28908 28871 -37
- Partials 7956 8514 +558
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
manas-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
May 2, 2025
apache#24232) (cherry picked from commit 611dc3f) (cherry picked from commit 1ac0898)
srinath-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
May 6, 2025
apache#24232) (cherry picked from commit 611dc3f) (cherry picked from commit 1ac0898)
manas-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
May 7, 2025
apache#24232) (cherry picked from commit 611dc3f) (cherry picked from commit b3c6f2a)
manas-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
May 7, 2025
apache#24232) (cherry picked from commit 611dc3f) (cherry picked from commit b3c6f2a)
srinath-ctds
pushed a commit
to datastax/pulsar
that referenced
this pull request
May 12, 2025
apache#24232) (cherry picked from commit 611dc3f) (cherry picked from commit b3c6f2a)
4 tasks
Member
Author
|
Addresses CVE-2024-13009 too. |
nodece
pushed a commit
to ascentstream/pulsar
that referenced
this pull request
May 28, 2025
apache#24232) (cherry picked from commit 611dc3f)
This is intentional, this is the "Unsupported when Assigned" behavior (a CVE thing), as Jetty 9 is EOL (End of Life)
If you still need |
KannarFr
pushed a commit
to CleverCloud/pulsar
that referenced
this pull request
Sep 22, 2025
walkinggo
pushed a commit
to walkinggo/pulsar
that referenced
this pull request
Oct 8, 2025
15 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #24114
Motivation & Modifications
Upgrade Jetty to 9.4.57.v20241219 to address CVE-2024-6763
Jetty 9.4.57.v20241219 contains backported CVE-2024-6763 fix in jetty/jetty.project#12532 although it's not explicitly mentioned and most security scanners don't yet contain the information that it's been addressed in 9.4.57.
More details:
Note: The backport is a partial mitigation and Jetty 9.4.57 will continue to be marked as vulnerable. There's a discussion and explanation here: https://gitlab.eclipse.org/security/cve-assignement/-/issues/25#note_2968611
Documentation
docdoc-requireddoc-not-neededdoc-complete