apache / apache/curator

[CURATOR-631] Upgrade Jersey to 2.35 or later and upgrade resteasy-jaxrs to a newer and compatible version

Open
#1,148 2 comments 0 reactions 0 assignees View on GitHub
imported-jira-issue rfe
Dominant language
Java
Stars
3.2k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Curator is pulling in resteasy-jaxrs 2.3.5 which is affected by multiple CVEs inlcuding CVE-2016-9606 and CVE-2014-3490. 

2.3.5 is also deprecated and needs to be upgraded. 

Curator is also pulling jersey 1.19.4 which is an old version and needs to be upgraded to 2.35 or later (3.0.4).

resteasy-jaxrs dependency cannot be higher than 2.x for compatibility with Jersey 1.x, this is why they need to be upgraded together.

 

---
Originally reported by dora.horvath, imported from: Upgrade Jersey to 2.35 or later and upgrade resteasy-jaxrs to a newer and compatible version


  • assignee: randgalt
  • status: Open
  • priority: Major
  • resolution: Unresolved
  • imported: 2025-01-21

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the dependency declarations and resolved dependency tree for Jersey and resteasy-jaxrs. Check the project’s existing build and test commands after selecting compatible versions. Done means both dependencies are upgraded together, compatibility is preserved, and the reported vulnerable versions are no longer pulled in.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.