[KARAF-7808] Stepup Jetty and pax-web to solve CVE-2024-22201

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.4.5
• Fix Version/s: 4.4.6
• Component/s: karaf
• Labels: dependency-upgrade security

Environment

Linux

• Target Version/s: 4.4.6
• Assignee: Jean-Baptiste Onofré
• Reporter: Karthick
• Created: 28/Feb/24 05:24
• Updated: 05/Apr/24 06:17
• Resolved: 05/Apr/24 06:17

Description

We use Karaf 4.4.5 that packs pax-web 8.0.24 which brings in jetty/http2 9.4.53. This Jetty version is affected by CVE CVE-2024-22201 that is business critical. Please bump up to newer version that solves the vulnerability.

Issue Links

• is blocked by: KARAF-7814 Upgrade to Pax Web 8.0.27 / Jetty 9.4.54.v20240208