Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KAFKA-16210: Update jose4j to 0.9.4 #15284

Merged
merged 1 commit into from Jan 30, 2024

Conversation

mike-lloyd03
Copy link
Contributor

@mike-lloyd03 mike-lloyd03 commented Jan 29, 2024

Committer Checklist (excluded from commit message)

  • Verify design and implementation
  • Verify test coverage and CI build status
  • Verify documentation (including upgrade notes)

org.bitbucket.b_c:jose4j 0.9.3 is susceptible to Denial of Service per CVE-2023-51775.

This PR updates kafka to use 0.9.4.

Thank you

@divijvaidya divijvaidya added dependencies Pull requests that update a dependency file backport-candidate This pull request is a candidate to be backported to previous versions labels Jan 30, 2024
Copy link
Contributor

@divijvaidya divijvaidya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion, when upgrading dependencies, please add the diff of the changes and explanation on why the upgrade is backward compatible etc.

In this case https://bitbucket.org/b_c/jose4j/wiki/Release%20Notes is the release notes for this dependency.

Seems like we are adding a constraint to limit (to a reasonable default) the computational resource that this algorithm can use. Sounds fair to me.

@divijvaidya divijvaidya changed the title Update jose4j to 0.9.4 to address CVE-2023-51775 KAFKA-16210: Update jose4j to 0.9.4 to address CVE-2023-51775 Jan 30, 2024
@divijvaidya divijvaidya changed the title KAFKA-16210: Update jose4j to 0.9.4 to address CVE-2023-51775 KAFKA-16210: Update jose4j to 0.9.4 Jan 30, 2024
@divijvaidya
Copy link
Contributor

the CI tests that are failing are unrelated since they don't use SASL (which is impacted by this dependency)

@divijvaidya divijvaidya merged commit d6199ad into apache:trunk Jan 30, 2024
1 check was pending
divijvaidya pushed a commit that referenced this pull request Jan 30, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
@divijvaidya
Copy link
Contributor

backported to 3.7

yyu1993 pushed a commit to yyu1993/kafka that referenced this pull request Feb 15, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
omkreddy pushed a commit that referenced this pull request Mar 18, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr pushed a commit to confluentinc/kafka that referenced this pull request Mar 22, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
msn-tldr added a commit to confluentinc/kafka that referenced this pull request Mar 25, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>

Co-authored-by: Mike Lloyd <49411532+mike-lloyd03@users.noreply.github.com>
msn-tldr added a commit to confluentinc/kafka that referenced this pull request Mar 25, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>

Co-authored-by: Mike Lloyd <49411532+mike-lloyd03@users.noreply.github.com>
msn-tldr added a commit to confluentinc/kafka that referenced this pull request Mar 25, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>

Co-authored-by: Mike Lloyd <49411532+mike-lloyd03@users.noreply.github.com>
msn-tldr added a commit to confluentinc/kafka that referenced this pull request Mar 25, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>

Co-authored-by: Mike Lloyd <49411532+mike-lloyd03@users.noreply.github.com>
msn-tldr added a commit to confluentinc/kafka that referenced this pull request Mar 25, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>

Co-authored-by: Mike Lloyd <49411532+mike-lloyd03@users.noreply.github.com>
msn-tldr added a commit to confluentinc/kafka that referenced this pull request Mar 25, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>

Co-authored-by: Mike Lloyd <49411532+mike-lloyd03@users.noreply.github.com>
clolov pushed a commit to clolov/kafka that referenced this pull request Apr 5, 2024
Co-authored-by: Mike Lloyd <mike.lloyd@teradata.com>

Reviewers: Divij Vaidya <diviv@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-candidate This pull request is a candidate to be backported to previous versions dependencies Pull requests that update a dependency file
Projects
None yet
2 participants