Bump jetty to 12.1.1 to resolve CVE-2025-5115#128
Conversation
|
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpgrades Jetty to 12.1.1 to resolve CVE-2025-5115, adapts the async socket resolver to the new Jetty API signature, bumps slf4j-api to 2.0.17, and verifies successful build/startup. Sequence diagram for updated resolve() method in JettyAsyncSocketAddressResolversequenceDiagram
participant Client
participant JettyAsyncSocketAddressResolver
participant ParentResolver
participant Promise
Client->>JettyAsyncSocketAddressResolver: resolve(host, port, context, promise)
JettyAsyncSocketAddressResolver->>JettyAsyncSocketAddressResolver: resolve(host)
alt address is present
JettyAsyncSocketAddressResolver->>Promise: succeeded([InetSocketAddress])
else address not present
JettyAsyncSocketAddressResolver->>ParentResolver: resolve(host, port, context, promise)
end
Class diagram for updated JettyAsyncSocketAddressResolver APIclassDiagram
class JettyAsyncSocketAddressResolver {
+JettyAsyncSocketAddressResolver(Executor executor, Scheduler scheduler, Logger log)
+resolve(String host, int port, Map<String, Object> context, Promise<List<InetSocketAddress>> promise)
-resolve(String host, int port, Promise<List<InetSocketAddress>> promise) // removed
-resolve(String host) Optional<InetAddress>
}
class ParentResolver {
+resolve(String host, int port, Map<String, Object> context, Promise<List<InetSocketAddress>> promise)
}
JettyAsyncSocketAddressResolver --|> ParentResolver
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
d8826be to
a650a2d
Compare
|
@mehradpk for some reason tests weren't run on this PR, PTAL at https://github.com/prestodb/airlift/actions/runs/18757839330/job/53514316697#step:4:23403 and make sure this isn't related to this code. |
|
@tdcmeehan The failure can be likely due to Jetty 12.1.x stricter shutdown behavior introduced as the test failed in CI is getting passed in local. jetty/jetty.project#2717 which made shutdown async-aware by switching to In Airlift, |
|
@mehradpk can you please raise a PR to fix it? |
|
So Jetty releases have minor and micro versions.
we should switch to Jetty 12.0.25+ which also fixes the CVE We can do a little more testing with Jetty 12.1 releases and make sure Presto works well before cutting a release with it @tdcmeehan @mehradpk WDYT ? |
|
Agreed |
This PR upgrades jetty version from 12.0.18 to 12.1.1 to address CVE-2025-5115.
Summary of Changes: