[ZOOKEEPER-4778] Patch jetty, netty, and logback to remove high severity vulnerabilities

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.10.0, 3.7.3, 3.8.4, 3.9.2
• Component/s: security
• Labels: pull-request-available
• Assignee: Damien Diederen
• Reporter: Ivgeni
• Created: 16/Dec/23 15:25
• Updated: 18/Oct/24 17:18
• Resolved: 31/Jan/24 08:43

Description

logback-core & logback-classic:

https://nvd.nist.gov/vuln/detail/CVE-2023-6378

netty-codec:

https://nvd.nist.gov/vuln/detail/CVE-2023-44487

jetty-io:

https://nvd.nist.gov/vuln/detail/CVE-2023-36478

 

Issue Links

• supercedes: ZOOKEEPER-4759 Handle Netty CVE-2023-44487 and CVE-2023-39325
• links to: GitHub Pull Request #2098
• links to: GitHub Pull Request #2118
• links to: GitHub Pull Request #2124
• links to: GitHub Pull Request #2125
• links to: GitHub Pull Request #2126