[KAFKA-17807] Update jetty-http & jetty-server [CVE-2024-8184]

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.8.0, 3.7.1, 3.9.0
• Assignee: Chia-Ping Tsai
• Reporter: Vishal
• Created: 16/Oct/24 06:21
• Updated: 21/Oct/24 12:12
• Resolved: 20/Oct/24 18:55

Description

1. jetty-http

https://nvd.nist.gov/vuln/detail/CVE-2024-6763

Current jetty-http version: 9.4.54.v20240208

Fix versions: 12.0.12

1. jetty-server

jetty-server, is vulnerable to https://nvd.nist.gov/vuln/detail/CVE-2024-8184

current jetty-server version: 9.4.54.v20240208

Fix Version : 10.0.24, 11.0.24, 12.0.9, 9.4.56

I created this report after I got an automated notification from a security image scanner.

Issue Links

• is related to: KAFKA-16437 Upgrade to Jakarta and JavaEE 10 in Kafka 4.0 (KIP-1032)

Sub-Tasks

• Update Jetty to 9.4.56 for trunk, 3.8 and 3.7: Resolved
• Update Jetty to 9.4.56 for 3.9: Resolved