[ZOOKEEPER-4439] Upgrade zk vulnerabilities

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.6.3
• Labels: security
• Assignee: Unassigned
• Reporter: Shivakumar
• Created: 07/Jan/22 11:00
• Updated: 12/Jan/23 22:01

Description

packages	Package Version	CVSS	Fix version
jetty-server	9.4.39.v20210325	5.5	fixed in 9.4.44
jetty-servlet	9.4.39.v20210325	5.5	fixed in 9.4.44
org.eclipse.jetty_jetty-servlet	9.4.39.v20210325	5.5	fixed in 9.4.44
com.fasterxml.jackson.core_jackson-databind	2.10.5.1, 2.13.2.1	7.5	fixed in 2.14, 2.13.1, 2.12.6, 2.13.4
jetty-io. (CVE-2021-34429)	9.4.39.v20210325	5.3	fixed in 11.0.6, 10.0.6, 9.4.43

Our security scan detected the above vulnerabilities

upgrade to correct versions for fixing vulnerabilities

Issue Links

• is cloned by: ZOOKEEPER-4599 Upgrade Jetty to avoid CVE-2022-2048