[HADOOP-18333] hadoop-client-runtime impact by CVE-2022-2047 CVE-2022-2048 due to shaded jetty

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.3
• Fix Version/s: 3.4.0, 3.3.5
• Component/s: build
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.5
• Hadoop Flags: Reviewed
• Assignee: Ashutosh Gupta
• Reporter: phoebe chen
• Created: 11/Jul/22 23:26
• Updated: 28/Jan/24 00:26
• Resolved: 24/Aug/22 00:17

Description

CVE-2022-2047 and CVE-2022-2048 is recently found for Eclipse Jetty, and impacts 9.4.0 thru 9.4.46.

In latest 3.3.3 of hadoop-client-runtime, it shaded 9.4.43.v20210629 version jetty which is impacted.

In Trunk, Jetty is in version 9.4.44.v20210927, which is still impacted.

Need to upgrade Jetty Version. 

Issue Links

• is duplicated by: HADOOP-18343 upgrade to jetty 9.4.48 due to CVE
• links to: GitHub Pull Request #4553
• links to: GitHub Pull Request #4583
• links to: GitHub Pull Request #4600