Merge pull request #431 from yetanalytics/jetty-cve-fix

Jetty CVE fixes
yetanalytics · Oct 16, 2024 · 8a774bb · 8a774bb
2 parents 8f76505 + 0e47fc6
commit 8a774bb
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 4 deletions.
diff --git a/.nvd/suppression.xml b/.nvd/suppression.xml
@@ -18,4 +18,12 @@
         <cpe>cpe:/a:clojure:clojure</cpe>
         <cve>CVE-2017-20189</cve>
     </suppress>
+    <!-- TODO: Remove suppression once we update to Jetty 12 -->
+    <suppress>
+        <notes><![CDATA[
+        file name: jetty-http-9.4.54.v20240208.jar
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty\-http@.*$</packageUrl>
+        <vulnerabilityName>CVE-2024-6763</vulnerabilityName>
+    </suppress>
 </suppressions>
diff --git a/deps.edn b/deps.edn
@@ -27,10 +27,15 @@
   com.zaxxer/HikariCP                      {:mvn/version "5.0.0"
                                             :exclusions  [org.slf4j/slf4j-api]}
   ;; Pedestal and Jetty webserver deps
-  io.pedestal/pedestal.jetty               {:mvn/version "0.6.3"
-                                            :exclusions  [org.eclipse.jetty.http2/http2-server]}
-  org.eclipse.jetty.http2/http2-server     {:mvn/version "9.4.54.v20240208"}
-  org.eclipse.jetty/jetty-alpn-java-server {:mvn/version "9.4.54.v20240208"}
+  io.pedestal/pedestal.jetty               {:mvn/version "0.6.3"}
+  org.eclipse.jetty/jetty-server           {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty/jetty-servlet          {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty/jetty-alpn-server      {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty.http2/http2-server     {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty/jetty-alpn-java-server {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty.websocket/websocket-api     {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty.websocket/websocket-servlet {:mvn/version "9.4.56.v20240826"}
+  org.eclipse.jetty.websocket/websocket-server  {:mvn/version "9.4.56.v20240826"}
   ;; Security deps
   buddy/buddy-core    {:mvn/version "1.11.418"
                        :exclusions [org.bouncycastle/bcprov-jdk18on