Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FISH-7835: upgrading okhttp and skipping kotlin dependencies #6507

Merged
merged 4 commits into from
Dec 17, 2023
Merged

FISH-7835: upgrading okhttp and skipping kotlin dependencies #6507

merged 4 commits into from
Dec 17, 2023

Conversation

breakponchito
Copy link
Contributor

@breakponchito breakponchito commented Dec 11, 2023 •
edited
Loading

Upgrading okhttp to fix CVE's CVE-2023-3635 and CVE-2023-0833

Description

This is a fix to resolve both CVE's reported:

  • Okio GzipSource unhandled exception Denial of Service: CVE-2023-3635
  • Component version with information disclosure flaw: CVE-2023-0833

Important Info

Blockers

Testing

New tests

Testing Performed

Execution of Jenkins pipeline

Testing Environment

ubuntu 20.04, azul JDK 11, maven 3.8.6

Documentation

Notes for Reviewers

@breakponchito
Copy link
Contributor Author

Jenkins test please

1 similar comment
@breakponchito
Copy link
Contributor Author

Jenkins test please

@breakponchito
Copy link
Contributor Author

Jenkins test please

@breakponchito
Copy link
Contributor Author

Jenkins test please

Pandrex247
Pandrex247 approved these changes Dec 15, 2023
View reviewed changes
Copy link
Member

@Pandrex247 Pandrex247 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not an expert on shading and everything we should be keeping an eye out for here, but LGTM. Just the one comment about property version placement

nucleus/packager/external/opentelemetry-repackaged/pom.xml Outdated
Comment on lines 63 to 64
<okhttp3-version>4.12.0</okhttp3-version>
<kotlin-version>1.8.21</kotlin-version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer if these were defined in the core-aggregator pom (Payara/core/pom.xml) along with all of the other dependency versions.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

already moved to the aggregator, thanks

@breakponchito
Copy link
Contributor Author

Jenkins test please

1 similar comment
@breakponchito
Copy link
Contributor Author

Jenkins test please

@breakponchito breakponchito merged commit d54cbc2 into payara:master Dec 17, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Pandrex247 Pandrex247 Pandrex247 approved these changes

@pdudits pdudits Awaiting requested review from pdudits

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@breakponchito @Pandrex247