Upgrade Jetty to 12.0.29 to resolve CVE-2025-5115#132
Conversation
|
|
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR safely addresses CVE-2025-5115 by staying on the Jetty 12.0.x line: the Jetty version is updated to 12.0.29 in the pom, and the resolver implementation is adjusted to match the superclass method signature. Entity relationship diagram for Jetty version property update in pom.xmlerDiagram
PROJECT ||--|| JETTY_VERSION : uses
JETTY_VERSION {
string version
}
PROJECT {
string name
string dep_jetty_version
}
Class diagram for updated JettyAsyncSocketAddressResolver method signatureclassDiagram
class JettyAsyncSocketAddressResolver {
+resolve(host: String, port: int, promise: Promise<List<InetSocketAddress>>)
}
class SuperClass {
+resolve(host: String, port: int, promise: Promise<List<InetSocketAddress>>)
}
JettyAsyncSocketAddressResolver --|> SuperClass
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
e64c633 to
084810e
Compare
|
@mehradpk As I see airlift CI runs fine - https://github.com/prestodb/airlift/actions/runs/19295511489 |
|
@agrawalreetika Yes. I've opened a PR now - prestodb/presto#26609 |
|
Instead of just upgrading Jetty in Presto, use your airlift version via jitpack in your Presto PR |
|
@agrawalreetika Airlift Jitpack build is successful. Even though the JitPack build succeeds, using that build inside Presto leads to multiple issues:
However, the full |
084810e to
59dda39
Compare
agrawalreetika
left a comment
There was a problem hiding this comment.
Thanks for the update @mehradpk
Code changes lgtm, I think if there is complexity in testing complete Presto CI without publishing, then we can try the Presto PR update after publishing the changes of airlift.
59dda39 to
20d0a64
Compare
Previous attempt to resolve this CVE by upgrading to 12.1.1 (#128) encountered issues.
Changes
This PR takes a more safer approach by staying within the 12.0.x line while still addressing the vulnerability.
PR includes fix to a test case failure
TestJettyHttpsClientSpnego.testNegotiateAuthScheme()caused by an upstream Jetty behavior change -The change came as part of
jetty 12.0.19release. Jetty team found a bug jetty/jetty.project#12916 whereInputStreamResponseListenerremains open in case of errors/exceptions, so as part of refactoring they also changed the behaviour of wrappingRuntimeExceptionasIOException. Now,RuntimeExceptionis re-thrown as it is without wrapping.jetty/jetty.project#12931
UncheckedIOExceptionwrapsIOExceptionin airlift -StringResponseHandler.handle()thus earlier the test case was passing but post this change
RuntimeExceptionis directly thrown leads to test case failure.As a fix, the expected exception is changed from
IOExceptiontoRuntimeException.Testing
Local Connector & Server Verification
Hive Distributed Queries Test Suite
Successfully executed
com.facebook.presto.hive.TestHiveDistributedQuerieslocally. Tests completed without failures or errors.