Jetty Releases 9.4.57

[olamy]

Jetty Versions:
This release process will produce releases: 9.4.57

Target Date:
Unspecified. Branch 9.4.x is now at End of Open Source/Community Support.

• EoCS (End of Community Support) for Jetty 9 - June 2022 #7958

Tasks:

• Create the release(s) issue.
• Update the target Jetty version(s) in the issue.
• Link this issue to the target GitHub Project(s).
• Assign this issue to a "release manager".
• Review draft security advisories. Ensure that issues are created and assigned to GitHub Projects to capture any advisories that will be announced.
• Update GitHub Project(s)
  • Create new project for the next releases (not this release).
  • Ensure new project is public (not private)
  • Freeze the target GitHub Project(s) by editing their names to "Jetty X.Y.Z FROZEN"
  • Review the issues/PRs assigned to the target GitHub Project(s). Any tasks that are not-yet-started are moved to next releases.
• Review dependabot status. Manually run dependabot if needed and review resulting PRs for inclusion.
  Such updates should only be included in the week before a release if there is a compelling security or stability reason to do so.
• Wait 24 hours from last change to the issues/PRs included in FROZEN GitHub Project(s).
• Verify target project(s) are complete.
• Assign issue to "build manager", who will stage the releases.
  • Create and use branches release/<ver> to perform version specific release work from.
  • Ensure git fetch --tags (as we potentially rewrite tag when re staging local tag can be out of sync and this command will fail and so fail the release script)
  • Ensure VERSION.txt additions for each release will be meaningful, descriptive, correct text.
  • Stage 9.4 release with Java 11.
  • Push release branches release/<ver> to to https://github.com/jetty/jetty.project
  • Push release tags jetty-<ver> to https://github.com/jetty/jetty.project
  • Edit a draft release (for each Jetty release) in GitHub (https://github.com/jetty/jetty.project/releases). Content is generated with the "changelog tool".
• Assign issue to "test manager", who will oversee the testing of the staged releases.
  • Test CometD.
  • Test Reactive HttpClient.
  • Test Jetty Docker images.
  • Check TCK CI.
  • Assign issue back to "release manager".
• Collect release votes from committers.
• Promote staged releases.
• Merge release branches back to main branches and delete release branches.
• Verify release existence in Maven Central by triggering the Jenkins builds of CometD.
• Update Jetty versions on the website ( follow instructions in jetty-website ).
  • Update (or check) Download page is updated.
  • Update (or check) documentation page(s) are updated (if applicable for supported versions of Jetty).
• Publish GitHub Releases.
• Publish any security advisories.
  • Edit VERSION.txt to include any actual CVE number next to correspondent issue.
  • Edit any issues for CVEs in github with their CVE number
• Notify downstream maintainers.
  • Docker maintainer.

[JackieTien97]

Hi, I'm a PMC member of Apache IoTDB in which we have a dependency on jetty 9.4.56.
However, there still exists a CVE in that version which seems to be resolved in v9.4.57.
So, I’d like to ask about the progress of the 9.4.57 release. When can it be available for dependency in the Maven repository?

[olamy]

@JackieTien97, this has been delayed. You should better understand that 9.x versions have been EoCS (End of Community Support) #7958 for more than two years now.
In your interest, it would be better to upgrade to 12 (with ee8 support if you cannot upgrade to a more recent servlet API)

[JackieTien97]

ok... thx

[tarunkalra7]

@olamy Could you please update the targeted date for this?

[joakime]

@tarunkalra7 the target date is unspecified for any open source release of 9.4.x

[joakime]

@tarunkalra7 you should be using a supported version of Jetty at this point in time.
Jetty 12 is that version.

Note: if you need to stick with javax.servlet and cannot upgrade to jakarta.servlet yet, then use the ee8 environment on Jetty 12, as that still supports the older javax.servlet namespace.

[HTHou]

Hi, is jetty 9.4.57 available? I see this version is already in the maven repo.

https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-server/9.4.57.v20241219/

[tarunkalra7]

Seems to be released. Also, I can see a release tag here https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.57.v20241219

Hi, is jetty 9.4.57 available? I see this version is already in the maven repo.

https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-server/9.4.57.v20241219/

[tarunkalra7]

@olamy @joakime I can see CVE-2024-6763 against the 9.4.57 version as well. Could you please confirm?
Ref : https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-http/9.4.57.v20241219

[olamy]

If you look at commit history you will see this one dd2c253
so yes fix for this CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6763 is included in this release

[joakime]

@HTHou @tarunkalra7 Jetty 9.x is no longer supported.

• EoCS (End of Community Support) for Jetty 9 - June 2022 #7958

You should be using a supported version of Jetty now.
Jetty 12 is that version. (Note: to maintain support for javax.servlet, use the ee8 environment on Jetty 12. The other environment are on jakarta.servlet namespace)

[HTHou]

The main reason we still use Jetty 9 is the Java 8 support. Once we decide to change the requirement of the JDK runtime version to 17, we will migrate to Jetty 12.

[tarunkalra7]

@olamy Is there any possibility to update this as well - GHSA-qh8g-58pp-2wxh to include the patched version on 9.x branch

[joakime]

@tarunkalra7 Jetty 9 is no longer to be used, it is no longer supported, that includes CVEs.

Note that CVE is not ready to be updated.
There are other factors you are not aware of.

[joakime]

Closing this as completed

[jpsikorra]

@tarunkalra7 Jetty 9 is no longer to be used, it is no longer supported, that includes CVEs.

Note that CVE is not ready to be updated. There are other factors you are not aware of.

Which other factors?

[jamessheridan]

Note that CVE is not ready to be updated.
There are other factors you are not aware of.

I really appreciate the effort that the Jetty maintainers have gone through to ensure that CVE-2024-6763 is squashed in this deprecated version of Jetty and that an official 9.4 release has been cut and made available. Thank you.

Can I kindly ask what the issue is with updating the CVE's Definition to state that jetty-9.4.57.v20241219 is not vulnerable? Until this is done vulnerability scanners will falsely report this issue as being live in this version when we know that it is not.

I understand that 9.4 is officially unsupported, and has been for some time, and that you do not want to encourage further use of this version, and I think most folks that are on 9.4 these days are aware of the need to upgrade. However, given the supported path now is to get onto 12 (as 10 and 11 are also EOL) the upgrade process isn't so straightforward for some users, given how widely used 9.4 was in many other - currently shipping - products and frameworks.

It sure would be great to have this CVE disappear from dashboards and reports while folks work on that upgrade path.

Thanks again.