[KARAF-7692] Upgrade Pax Web 8.0.21 / Jetty to 9.4.52

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 4.3.9
• Component/s: karaf
• Labels: dependency-upgrade
• Target Version/s: 4.4.4
• Assignee: Jean-Baptiste Onofré
• Reporter: Karthick
• Created: 04/May/23 11:14
• Updated: 05/Sep/23 13:01
• Resolved: 05/Sep/23 13:01

Description

As per CVE https://nvd.nist.gov/vuln/detail/CVE-2023-26048 , Jetty version till 9.4.50 is impacted in a multipart issue. This is howwver fixed by jetty in later versions. We use Apache Karaf that brings the Jetty through pax-web. Please stepup the components so that the final karaf runtime has 9.4.51 Jetty in it.

 

Other CVE https://nvd.nist.gov/vuln/detail/CVE-2023-26049 is also fixed by this stepup

Issue Links

• is duplicated by: KARAF-7745 Upgrade to Pax Web 8.0.22 & Jetty 9.4.52.v20230823