Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FISH-7835: upgrading okhttp and skipping kotlin dependencies #6507

Conversation

breakponchito
Copy link
Contributor

@breakponchito breakponchito commented Dec 11, 2023

Upgrading okhttp to fix CVE's CVE-2023-3635 and CVE-2023-0833

Description

This is a fix to resolve both CVE's reported:

  • Okio GzipSource unhandled exception Denial of Service: CVE-2023-3635
  • Component version with information disclosure flaw: CVE-2023-0833

Important Info

Blockers

Testing

New tests

Testing Performed

Execution of Jenkins pipeline

Testing Environment

ubuntu 20.04, azul JDK 11, maven 3.8.6

Documentation

Notes for Reviewers

@breakponchito
Copy link
Contributor Author

Jenkins test please

1 similar comment
@breakponchito
Copy link
Contributor Author

Jenkins test please

@breakponchito
Copy link
Contributor Author

Jenkins test please

@breakponchito
Copy link
Contributor Author

Jenkins test please

Copy link
Member

@Pandrex247 Pandrex247 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not an expert on shading and everything we should be keeping an eye out for here, but LGTM. Just the one comment about property version placement

Comment on lines 63 to 64
<okhttp3-version>4.12.0</okhttp3-version>
<kotlin-version>1.8.21</kotlin-version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer if these were defined in the core-aggregator pom (Payara/core/pom.xml) along with all of the other dependency versions.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

already moved to the aggregator, thanks

@breakponchito
Copy link
Contributor Author

Jenkins test please

1 similar comment
@breakponchito
Copy link
Contributor Author

Jenkins test please

@breakponchito breakponchito merged commit d54cbc2 into payara:master Dec 17, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants