opensearch-project / opensearch-project/sql-jdbc
[CVE] jetty CVE
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 28
- Forks
- 39
- PR merge metrics
- No merged PRs in 30d
Description
What is the bug?
The project uses jetty version 11.0.14 while the versions with fixes are not yet available.
From workflow:
| CVE | Severity | CVSS Score | Vulnerable Library | Suggested Fix | Issue |
|---|---|---|---|---|---|
| WS-2023-0236Path to dependency file: /build.gradlePath to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.eclipse.jetty/jetty-xml/11.0.14/30210aaf71149eb446ce9cb0b659472d0f7d1ab5/jetty-xml-11.0.14.jarDependency Hierarchy:-> wiremock-3.0.0-beta-2.jar (Root Library) -> jetty-webapp-11.0.14.jar -> ❌ jetty-xml-11.0.14.jar (Vulnerable Library) | Low | 3.9 | jetty-xml-11.0.14.jar | Upgrade to version: org.eclipse.jetty:jetty-xml:10.0.16,11.0.16,12.0.0 | #59 |
CVE Severity CVSS Score Vulnerable Library Suggested Fix Issue
WS-2023-0236
Path to dependency file: /build.gradle
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.eclipse.jetty/jetty-xml/11.0.14/30210aaf71149eb446ce9cb0b659472d0f7d1ab5/jetty-xml-11.0.14.jar
Dependency Hierarchy:
-> wiremock-3.0.0-beta-2.jar (Root Library)
-> jetty-webapp-11.0.14.jar
-> ❌ jetty-xml-11.0.14.jar (Vulnerable Library)
Low 3.9 jetty-xml-11.0.14.jar Upgrade to version: org.eclipse.jetty:jetty-xml:10.0.16,11.0.16,12.0.0 https://github.com/opensearch-project/sql-jdbc/issues/59
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with /build.gradle and inspect how wiremock-3.0.0-beta-2 brings in jetty-webapp and jetty-xml 11.0.14. Update the dependency to a listed fixed Jetty version, then verify that the resolved dependency is no longer 11.0.14 and that the vulnerability is addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100