Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exclude vertx from bookkeeper-http package #7997

Merged
merged 3 commits into from
Sep 8, 2020

Conversation

wolfstudy
Copy link
Member

Signed-off-by: xiaolong.ran rxl@apache.org

Fixes #7931

Motivation

$ mvn dependency:tree|grep vertx

Output:

[INFO] +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:compile
[INFO] +- io.vertx:vertx-core:jar:3.5.3:compile
[INFO] +- io.vertx:vertx-web:jar:3.5.3:compile
[INFO] |  +- io.vertx:vertx-auth-common:jar:3.5.3:compile
[INFO] |  \- io.vertx:vertx-bridge-common:jar:3.5.3:compile
[INFO] |  +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:provided
[INFO] |  +- io.vertx:vertx-core:jar:3.5.3:provided
[INFO] |  \- io.vertx:vertx-web:jar:3.5.3:provided
[INFO] |     +- io.vertx:vertx-auth-common:jar:3.5.3:provided
[INFO] |     \- io.vertx:vertx-bridge-common:jar:3.5.3:provided

Modifications

  • exclude vertx from bookkeeper-http package and include vertx of 3.5.3 to vertx-http-server

Signed-off-by: xiaolong.ran <rxl@apache.org>
Signed-off-by: xiaolong.ran <rxl@apache.org>
</exclusions>
</dependency>
<dependency>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This tmp fix lgtm. And ideal fix would be changing the io.vertx version in BookKeeper. Please help open an issue/PR in BookKeeper, and add an comments here. So when using the BookKeeper with the fix, we could change this back.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, i already send a pull request on bk, refer to: apache/bookkeeper#2410

Signed-off-by: xiaolong.ran <rxl@apache.org>
@wolfstudy
Copy link
Member Author

/pulsarbot run-failure-checks

1 similar comment
@wolfstudy
Copy link
Member Author

/pulsarbot run-failure-checks

@wolfstudy wolfstudy merged commit 98233c0 into apache:master Sep 8, 2020
lbenc135 pushed a commit to lbenc135/pulsar that referenced this pull request Oct 3, 2020
Signed-off-by: xiaolong.ran <rxl@apache.org>

### Motivation

```
$ mvn dependency:tree|grep vertx
```

Output:
```
[INFO] +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:compile
[INFO] +- io.vertx:vertx-core:jar:3.5.3:compile
[INFO] +- io.vertx:vertx-web:jar:3.5.3:compile
[INFO] |  +- io.vertx:vertx-auth-common:jar:3.5.3:compile
[INFO] |  \- io.vertx:vertx-bridge-common:jar:3.5.3:compile
[INFO] |  +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:provided
[INFO] |  +- io.vertx:vertx-core:jar:3.5.3:provided
[INFO] |  \- io.vertx:vertx-web:jar:3.5.3:provided
[INFO] |     +- io.vertx:vertx-auth-common:jar:3.5.3:provided
[INFO] |     \- io.vertx:vertx-bridge-common:jar:3.5.3:provided
```

### Modifications

- exclude `vertx` from bookkeeper-http package and include vertx of `3.5.3` to `vertx-http-server`
codelipenghui pushed a commit that referenced this pull request Oct 14, 2020
Signed-off-by: xiaolong.ran <rxl@apache.org>

### Motivation

```
$ mvn dependency:tree|grep vertx
```

Output:
```
[INFO] +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:compile
[INFO] +- io.vertx:vertx-core:jar:3.5.3:compile
[INFO] +- io.vertx:vertx-web:jar:3.5.3:compile
[INFO] |  +- io.vertx:vertx-auth-common:jar:3.5.3:compile
[INFO] |  \- io.vertx:vertx-bridge-common:jar:3.5.3:compile
[INFO] |  +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:provided
[INFO] |  +- io.vertx:vertx-core:jar:3.5.3:provided
[INFO] |  \- io.vertx:vertx-web:jar:3.5.3:provided
[INFO] |     +- io.vertx:vertx-auth-common:jar:3.5.3:provided
[INFO] |     \- io.vertx:vertx-bridge-common:jar:3.5.3:provided
```

### Modifications

- exclude `vertx` from bookkeeper-http package and include vertx of `3.5.3` to `vertx-http-server`

(cherry picked from commit 98233c0)
@codelipenghui
Copy link
Contributor

cherry-picked to branch-2.6

wolfstudy added a commit that referenced this pull request Oct 30, 2020
wolfstudy added a commit that referenced this pull request Oct 30, 2020
Signed-off-by: xiaolong.ran <rxl@apache.org>

### Motivation

```
$ mvn dependency:tree|grep vertx
```

Output:
```
[INFO] +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:compile
[INFO] +- io.vertx:vertx-core:jar:3.5.3:compile
[INFO] +- io.vertx:vertx-web:jar:3.5.3:compile
[INFO] |  +- io.vertx:vertx-auth-common:jar:3.5.3:compile
[INFO] |  \- io.vertx:vertx-bridge-common:jar:3.5.3:compile
[INFO] |  +- org.apache.bookkeeper.http:vertx-http-server:jar:4.10.0:provided
[INFO] |  +- io.vertx:vertx-core:jar:3.5.3:provided
[INFO] |  \- io.vertx:vertx-web:jar:3.5.3:provided
[INFO] |     +- io.vertx:vertx-auth-common:jar:3.5.3:provided
[INFO] |     \- io.vertx:vertx-bridge-common:jar:3.5.3:provided
```

### Modifications

- exclude `vertx` from bookkeeper-http package and include vertx of `3.5.3` to `vertx-http-server`

(cherry picked from commit 98233c0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2018-12540 pulsar use of io.vertx-web.jar vertx 3.4.1
3 participants