[ZOOKEEPER-4390] Backport ZOOKEEPER-4337 for branch-3.5 and branch-3.6

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5.9
• Component/s: security
• Labels: pull-requests-available
• Assignee: Ananya Singh
• Reporter: Ananya Singh
• Created: 28/Sep/21 05:15
• Updated: 01/Aug/22 08:25
• Resolved: 01/Aug/22 08:25

Description

Our security tool raised the following security flaws on zookeeper 3.5.9: 

CVE-2021-28163: https://nvd.nist.gov/vuln/detail/CVE-2021-28163

CVE-2021-28169: https://nvd.nist.gov/vuln/detail/CVE-2021-28169

CVE-2021-34428: https://nvd.nist.gov/vuln/detail/CVE-2021-34428

 

It is a vulnerability related to jar jetty-http-9.4.35.v20201120.jar

Issue Links

• relates to: ZOOKEEPER-4337 CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0
• links to: Github Pull Request #1768
• links to: Github Pull Request #1769