[ZOOKEEPER-4700] Update Jetty for fixing CVE-2023-26048 and CVE-2023-26049

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.8.1
• Fix Version/s: 3.9.0, 3.8.2
• Labels: pull-request-available
• Assignee: Szucs Villo
• Reporter: Beltran
• Created: 30/May/23 15:44
• Updated: 04/Aug/23 11:28
• Resolved: 16/Jun/23 19:49

Description

The Zookeeper latest version (v3.8.1) includes jetty-server-9.4.49.v20220914.jar that includes 2 vulnerabilities reported by the scanners: CVE-2023-26048 and CVE-2023-26049.

The goal is to upgrade jetty to 9.4.51. This dependency was already upgraded in Kafka KAFKA-14983.

Issue Links

• is related to: ZOOKEEPER-4696 Update for Zookeeper latest version
• links to: GitHub Pull Request #2002
• links to: GitHub Pull Request #2007