commit	d2f60edd43fa236ae7c7467e173d7f29062e8340	[log] [tgz]
author	Damien Diederen <ddiederen@apache.org>	Thu Dec 24 14:43:44 2020 +0000
committer	Norbert Kalmar <nkalmar@apache.org>	Wed Jan 06 17:16:32 2021 +0100
tree	78b20939c2808e3adcbd6c63e789ac2cd7bc0ff7
parent	713b41b4b3358a75da802f4b0f982a65b8213f2a [diff]

ZOOKEEPER-4023: dependency-check:check failing - Jetty 9.4.34.v20201102 - CVE-2020-27218

Bump jetty.version to 9.4.35.v20201120.

The [release notes](https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.35.v20201120)
mention [issues 5605](https://github.com/eclipse/jetty.project/issues/5605):

> java.io.IOException: unconsumed input during http request parsing

which seems to match the description of
[CVE-2020-27218](http://cve.circl.lu/cve/CVE-2020-27218)

Author: Damien Diederen <dd@crosstwine.com>

Reviewers: Enrico Olivelli <eolivelli@apache.org>, Norbert Kalmar <nkalmar@apache.org>

Closes #1554 from ztzg/jetty-upgrade-CVE-2020-27218-branch-3.5

(cherry picked from commit eb348a1e242397030147720eaeace4c75f25fc92)

build.xml[diff]
pom.xml[diff]
zookeeper-server/src/main/resources/lib/jetty-http-9.4.34.v20201102.LICENSE.txt[Deleted - diff]
zookeeper-server/src/main/resources/lib/jetty-http-9.4.35.v20201120.LICENSE.txt[Renamed from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]
zookeeper-server/src/main/resources/lib/jetty-io-9.4.34.v20201102.LICENSE.txt[Deleted - diff]
zookeeper-server/src/main/resources/lib/jetty-io-9.4.35.v20201120.LICENSE.txt[Copied from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]
zookeeper-server/src/main/resources/lib/jetty-security-9.4.34.v20201102.LICENSE.txt[Deleted - diff]
zookeeper-server/src/main/resources/lib/jetty-security-9.4.35.v20201120.LICENSE.txt[Copied from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]
zookeeper-server/src/main/resources/lib/jetty-server-9.4.34.v20201102.LICENSE.txt[Deleted - diff]
zookeeper-server/src/main/resources/lib/jetty-server-9.4.35.v20201120.LICENSE.txt[Copied from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]
zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.34.v20201102.LICENSE.txt[Deleted - diff]
zookeeper-server/src/main/resources/lib/jetty-servlet-9.4.35.v20201120.LICENSE.txt[Copied from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]
zookeeper-server/src/main/resources/lib/jetty-util-9.4.34.v20201102.LICENSE.txt[Deleted - diff]
zookeeper-server/src/main/resources/lib/jetty-util-9.4.35.v20201120.LICENSE.txt[Copied from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]
zookeeper-server/src/main/resources/lib/jetty-util-ajax-9.4.35.v20201120.LICENSE.txt[Copied from zookeeper-server/src/main/resources/lib/jetty-client-9.4.34.v20201102.LICENSE.txt - diff]

15 files changed

tree: 78b20939c2808e3adcbd6c63e789ac2cd7bc0ff7

README.md

Apache ZooKeeper

alt text

For the latest information about Apache ZooKeeper, please visit our website at:

http://zookeeper.apache.org/

and our wiki, at:

https://cwiki.apache.org/confluence/display/ZOOKEEPER

Packaging/release artifacts

Either downloaded from https://zookeeper.apache.org/releases.html or found in zookeeper-assembly/target directory after building the project with maven.

apache-zookeeper-[version].tar.gz

    Contains all the source files which can be built by running:
    mvn clean install

    To generate an aggregated apidocs for zookeeper-server and zookeeper-jute:
    mvn javadoc:aggregate
    (generated files will be at target/site/apidocs)

apache-zookeeper-[version]-bin.tar.gz

    Contains all the jar files required to run ZooKeeper
    Full documentation can also be found in the docs folder

As of version 3.5.5, the parent, zookeeper and zookeeper-jute artifacts are deployed to the central repository after the release is voted on and approved by the Apache ZooKeeper PMC:

https://repo1.maven.org/maven2/org/apache/zookeeper/zookeeper/

Java 8

If you are going to compile with Java 1.8, you should use a recent release at u211 or above.

Contributing

We always welcome new contributors to the project! See How to Contribute for details on how to submit patch through pull request and our contribution workflow.