Security vulnerabilities found in jetty (dependency)

[BrunoBonacci]

Hi,

lein-nvd is reporting a number of security vulnerabilities in jetty (one of transitive dependencies)

here the dep tree:

 [com.cognitect.aws/api "0.8.498"]
   [com.cognitect/http-client "0.1.105"]
     [org.eclipse.jetty/jetty-client "9.4.27.v20200227"]
       [org.eclipse.jetty/jetty-io "9.4.27.v20200227"]
     [org.eclipse.jetty/jetty-http "9.4.27.v20200227"]
     [org.eclipse.jetty/jetty-util "9.4.27.v20200227"]

here the vulnerabilities reported

+---------------------------------+------------------------------------------------+
| dependency                      | status                                         |
+---------------------------------+------------------------------------------------+
| jetty-util-9.4.27.v20200227.jar | CVE-2019-17638, CVE-2020-27218, CVE-2020-27216 |
+---------------------------------+------------------------------------------------+

here the CVE details

• CVE-2019-17638 - CRITICAL
• CVE-2020-27216 - HIGH
• CVE-2020-27218 - MEDIUM

All above vulnerabilities have been fixed jetty in the following version, please update to:

[org.eclipse.jetty/jetty-client "9.4.35.v20201120"] 
[org.eclipse.jetty/jetty-http   "9.4.35.v20201120"] 
[org.eclipse.jetty/jetty-util   "9.4.35.v20201120"] 

[dchelimsky]

Thanks for the report. I don't know how long it will be for us to get this through. In the mean time, for anybody unaware who may read this, you should be able to add these explicit jetty dependencies to your tools.deps, lein, or boot configuration to override the transitive dependencies.

[dchelimsky]

Fixed in 6222887

Released in aws-api-0.8.505

Upgraded to cognitect/http-client-0.1.106, which depends on jetty 9.4.36.v20210114

[BrunoBonacci]

Hi,

thanks for the fix.
Unfortunately, it appears that this version is now affected by another vulnerability.

  using nvd-clojure:  and dependency-check: 5.3.2
+-----------------------------------+----------------+
| dependency                        | status         |
+-----------------------------------+----------------+
| jetty-client-9.4.36.v20210114.jar | CVE-2020-27223 |
| jetty-http-9.4.36.v20210114.jar   | CVE-2020-27223 |
+-----------------------------------+----------------+

2 vulnerabilities detected. Severity: MEDIUM