HADOOP-18712 upgrade to jetty 9.4.51 due to cve #5574

pjfanning · 2023-04-19T20:47:27Z

Description of PR

How was this patch tested?

For code changes:

Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

hadoop-yetus · 2023-04-20T01:12:53Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 47s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	xmllint	0m 0s		xmllint was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	16m 45s		Maven dependency ordering for branch
+1 💚	mvninstall	28m 46s		trunk passed
+1 💚	compile	25m 28s		trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	compile	21m 54s		trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
-1 ❌	mvnsite	11m 28s	/branch-mvnsite-root.txt	root in trunk failed.
-1 ❌	javadoc	0m 28s	/branch-javadoc-root-jdkUbuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1.txt	root in trunk failed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1.
+1 💚	javadoc	7m 52s		trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
-1 ❌	shadedclient	30m 6s		branch has errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 55s		Maven dependency ordering for patch
+1 💚	mvninstall	25m 7s		the patch passed
+1 💚	compile	24m 46s		the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javac	24m 46s		the patch passed
+1 💚	compile	21m 54s		the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
-1 ❌	javac	21m 54s	/results-compile-javac-root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09.txt	root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~~20.04.1-b09 with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~~20.04.1-b09 generated 2 new + 2602 unchanged - 1 fixed = 2604 total (was 2603)
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-1 ❌	mvnsite	6m 35s	/patch-mvnsite-root.txt	root in the patch failed.
+1 💚	shellcheck	0m 0s		No new issues.
-1 ❌	javadoc	8m 44s	/results-javadoc-javadoc-root-jdkUbuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1.txt	root-jdkUbuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 generated 1387 new + 0 unchanged - 0 fixed = 1387 total (was 0)
+1 💚	javadoc	7m 20s		the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
-1 ❌	shadedclient	39m 48s		patch has errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	4m 6s	/patch-unit-root.txt	root in the patch failed.
+0 🆗	asflicense	0m 30s		ASF License check generated no output?
		262m 29s

Subsystem	Report/Notes
Docker	ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/1/artifact/out/Dockerfile
GITHUB PR	#5574
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 8c1f5d1b786a 4.15.0-206-generic #217-Ubuntu SMP Fri Feb 3 19:10:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `9f1b5ce`
Default Java	Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/1/testReport/
Max. process+thread count	192 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/1/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

hadoop-yetus · 2023-04-21T02:20:49Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 45s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 1s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	xmllint	0m 0s		xmllint was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	18m 15s		Maven dependency ordering for branch
+1 💚	mvninstall	29m 20s		trunk passed
+1 💚	compile	25m 6s		trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	compile	21m 43s		trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
+1 💚	mvnsite	26m 27s		trunk passed
+1 💚	javadoc	8m 29s		trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javadoc	7m 28s		trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
+1 💚	shadedclient	38m 5s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 51s		Maven dependency ordering for patch
+1 💚	mvninstall	25m 16s		the patch passed
+1 💚	compile	24m 32s		the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javac	24m 32s		the patch passed
+1 💚	compile	21m 50s		the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
-1 ❌	javac	21m 50s	/results-compile-javac-root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09.txt	root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~~20.04.1-b09 with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~~20.04.1-b09 generated 2 new + 2601 unchanged - 1 fixed = 2603 total (was 2602)
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	20m 58s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	8m 16s		the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javadoc	7m 25s		the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
+1 💚	shadedclient	38m 53s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	766m 5s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 31s		The patch does not generate ASF License warnings.
		1063m 14s

Reason	Tests
Failed junit tests	hadoop.mapreduce.v2.TestMRJobsWithProfiler
	hadoop.mapreduce.v2.TestMRJobs
	hadoop.mapreduce.v2.TestUberAM

Subsystem	Report/Notes
Docker	ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/2/artifact/out/Dockerfile
GITHUB PR	#5574
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 6cb09afdf516 4.15.0-206-generic #217-Ubuntu SMP Fri Feb 3 19:10:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `fe9b208`
Default Java	Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/2/testReport/
Max. process+thread count	2447 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/2/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

ayushtkn

Some Javac warnings are getting triggered due to this, can you give a check. Rest no relevant test failures, should be good once these warnings are sorted

pjfanning · 2023-04-22T12:13:05Z

@ayushtkn are these the warnings - https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/2/artifact/out/results-compile-javac-root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09.txt ?

If so, I'd be pretty sure they are unrelated to jetty changes. The code is these warnings is Mockito code based on Hadoop proxy classes - and no sign of Jetty imports anywhere near those classes.

pjfanning · 2023-04-22T12:20:36Z

My IDE shows multiple warnings for any use with Mockito of any(Class.class). I don't know what to do about these other than adding many @SuppressWarnings("unchecked") in the code.

ayushtkn · 2023-04-22T13:58:29Z

Yahh, not sure why it is showing here, it has message towards the right as well

generated 2 new + 2601 unchanged - 1 fixed = 2603 total (was 2602)

hadoop-yetus · 2023-04-23T06:31:31Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 47s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 0s		codespell was not available.
+0 🆗	detsecrets	0m 0s		detect-secrets was not available.
+0 🆗	xmllint	0m 0s		xmllint was not available.
+0 🆗	shelldocs	0m 0s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 43s		Maven dependency ordering for branch
+1 💚	mvninstall	29m 17s		trunk passed
+1 💚	compile	25m 32s		trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	compile	31m 9s		trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
+1 💚	mvnsite	31m 40s		trunk passed
+1 💚	javadoc	8m 47s		trunk passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javadoc	7m 36s		trunk passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
+1 💚	shadedclient	40m 21s		branch has no errors when building and testing our client artifacts.
-0 ⚠️	patch	40m 38s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 54s		Maven dependency ordering for patch
+1 💚	mvninstall	28m 20s		the patch passed
+1 💚	compile	28m 16s		the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javac	28m 16s		the patch passed
+1 💚	compile	21m 52s		the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
-1 ❌	javac	21m 52s	/results-compile-javac-root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09.txt	root-jdkPrivateBuild-1.8.0_362-8u362-ga-0ubuntu1~~20.04.1-b09 with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~~20.04.1-b09 generated 2 new + 2602 unchanged - 1 fixed = 2604 total (was 2603)
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	21m 12s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	8m 13s		the patch passed with JDK Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1
+1 💚	javadoc	7m 23s		the patch passed with JDK Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
+1 💚	shadedclient	39m 24s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	780m 12s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 28s		The patch does not generate ASF License warnings.
		1099m 55s

Reason	Tests
Failed junit tests	hadoop.mapreduce.v2.TestMRJobsWithProfiler
	hadoop.mapreduce.v2.TestMRJobs
	hadoop.mapreduce.v2.TestUberAM
	hadoop.hdfs.server.datanode.TestDirectoryScanner
	hadoop.hdfs.TestRollingUpgrade

Subsystem	Report/Notes
Docker	ClientAPI=1.42 ServerAPI=1.42 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/3/artifact/out/Dockerfile
GITHUB PR	#5574
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 46de3597bd2e 4.15.0-206-generic #217-Ubuntu SMP Fri Feb 3 19:10:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `17e62c3`
Default Java	Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.18+10-post-Ubuntu-0ubuntu120.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_362-8u362-ga-0ubuntu1~20.04.1-b09
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/3/testReport/
Max. process+thread count	2654 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-5574/3/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

ayushtkn

LGTM

pjfanning · 2023-04-23T19:50:03Z

raised #5585 for branch-3.3

…anning. (#5574) (#5585) Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

…ibuted by PJ Fanning. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

HADOOP-18712 upgrade to jetty 9.4.51 due to cve

fe9b208

pjfanning force-pushed the HADOOP-18712-jetty branch from 9f1b5ce to fe9b208 Compare April 20, 2023 08:36

ayushtkn reviewed Apr 22, 2023

View reviewed changes

Merge branch 'trunk' into HADOOP-18712-jetty

17e62c3

ayushtkn approved these changes Apr 23, 2023

View reviewed changes

ayushtkn merged commit b683769 into apache:trunk Apr 23, 2023

pjfanning deleted the HADOOP-18712-jetty branch April 23, 2023 19:32

ayushtkn pushed a commit that referenced this pull request Apr 26, 2023

HADOOP-18712. Upgrade to jetty 9.4.51 due to cve. Contributed by PJ F…

040c23c

…anning. (#5574) (#5585) Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

basapuram-kumar pushed a commit to acceldata-io/hadoop that referenced this pull request Sep 23, 2025

HADOOP-18712. Upgrade to jetty 9.4.51 due to cve (apache#5574). Contr…

364d3a6

…ibuted by PJ Fanning. Signed-off-by: Ayush Saxena <ayushsaxena@apache.org>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

HADOOP-18712 upgrade to jetty 9.4.51 due to cve #5574

HADOOP-18712 upgrade to jetty 9.4.51 due to cve #5574

Uh oh!

pjfanning commented Apr 19, 2023

Uh oh!

hadoop-yetus commented Apr 20, 2023

Uh oh!

hadoop-yetus commented Apr 21, 2023

Uh oh!

ayushtkn left a comment

Uh oh!

pjfanning commented Apr 22, 2023

Uh oh!

pjfanning commented Apr 22, 2023

Uh oh!

ayushtkn commented Apr 22, 2023

Uh oh!

hadoop-yetus commented Apr 23, 2023

Uh oh!

ayushtkn left a comment

Uh oh!

pjfanning commented Apr 23, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

HADOOP-18712 upgrade to jetty 9.4.51 due to cve #5574

HADOOP-18712 upgrade to jetty 9.4.51 due to cve #5574

Uh oh!

Conversation

pjfanning commented Apr 19, 2023

Description of PR

How was this patch tested?

For code changes:

Uh oh!

hadoop-yetus commented Apr 20, 2023

Uh oh!

hadoop-yetus commented Apr 21, 2023

Uh oh!

ayushtkn left a comment

Choose a reason for hiding this comment

Uh oh!

pjfanning commented Apr 22, 2023

Uh oh!

pjfanning commented Apr 22, 2023

Uh oh!

ayushtkn commented Apr 22, 2023

Uh oh!

hadoop-yetus commented Apr 23, 2023

Uh oh!

ayushtkn left a comment

Choose a reason for hiding this comment

Uh oh!

pjfanning commented Apr 23, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants