Security vulnerabilities exist in current jetty dependency

[asilverman]

Dependencies

[com.cognitect.aws/api "0.8.423"]
[com.cognitect.aws/endpoints "1.1.11.705"]
[com.cognitect.aws/sqs "770.2.568.0"]

Description with failing test case

Current jetty dependency (v 9.4.15.v20190215) used by com.cognitect.aws has security vulnerabilities, see here. Consider using jetty version 9.4.17.v20190418 and above (preferably 9.4.18.v20190429 since this is the one used by pedestal.io v0.5.7)

Result from lein deps :tree

[clojure-complete "0.2.5" :exclusions [[org.clojure/clojure]]]
 [com.cognitect.aws/api "0.8.423"]
   [com.cognitect/http-client "0.1.101"]
     [org.eclipse.jetty/jetty-client "9.4.15.v20190215"]
       [org.eclipse.jetty/jetty-io "9.4.15.v20190215"]
     [org.eclipse.jetty/jetty-http "9.4.15.v20190215"]
     [org.eclipse.jetty/jetty-util "9.4.15.v20190215"]
   [org.clojure/clojure "1.10.1"]
     [org.clojure/core.specs.alpha "0.2.44"]
     [org.clojure/spec.alpha "0.2.176"]
   [org.clojure/core.async "0.5.527"]
     [org.clojure/tools.analyzer.jvm "0.7.2"]
       [org.clojure/core.memoize "0.5.9"]
         [org.clojure/core.cache "0.6.5"]
           [org.clojure/data.priority-map "0.0.7"]
       [org.clojure/tools.analyzer "0.6.9"]
       [org.clojure/tools.reader "1.0.0-beta4"]
       [org.ow2.asm/asm-all "4.2"]
   [org.clojure/data.json "0.2.7"]
   [org.clojure/data.xml "0.2.0-alpha6"]
     [org.clojure/data.codec "0.1.0"]
   [org.clojure/tools.logging "0.5.0"]
 [com.cognitect.aws/endpoints "1.1.11.705"]
 [com.cognitect.aws/sqs "770.2.568.0"]
 [nrepl "0.6.0" :exclusions [[org.clojure/clojure]]]

[dchelimsky]

Thanks for the heads up on this one. I've passed this info on to my colleagues who manage the http-client. Once they get a release out I'll get out a release of aws-api with an upgrade to the new http-client. Until then, you can use the latest jetty libs by including it as explicit dependencies (true for leiningen and tools.deps).

[dchelimsky]

cognitect.http-client-0.1.104 was just released with an upgrade to jetty-9.4.24.v20191120. I'll try to get a release of aws-client out with this upgrade this week.

[dchelimsky]

Released today: https://github.com/cognitect-labs/aws-api/blob/master/CHANGES.md#08430--2020-02-10