{"action":"created","issue":{"url":"https://api.github.com/repos/druid-io/druid/issues/3595","repository_url":"https://api.github.com/repos/druid-io/druid","labels_url":"https://api.github.com/repos/druid-io/druid/issues/3595/labels{/name}","comments_url":"https://api.github.com/repos/druid-io/druid/issues/3595/comments","events_url":"https://api.github.com/repos/druid-io/druid/issues/3595/events","html_url":"https://github.com/druid-io/druid/issues/3595","id":184179576,"number":3595,"title":"Jetty Dependency Outdated and Vulnerable","user":{"login":"hland","id":18402965,"avatar_url":"https://avatars.githubusercontent.com/u/18402965?v=3","gravatar_id":"","url":"https://api.github.com/users/hland","html_url":"https://github.com/hland","followers_url":"https://api.github.com/users/hland/followers","following_url":"https://api.github.com/users/hland/following{/other_user}","gists_url":"https://api.github.com/users/hland/gists{/gist_id}","starred_url":"https://api.github.com/users/hland/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hland/subscriptions","organizations_url":"https://api.github.com/users/hland/orgs","repos_url":"https://api.github.com/users/hland/repos","events_url":"https://api.github.com/users/hland/events{/privacy}","received_events_url":"https://api.github.com/users/hland/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/druid-io/druid/labels/Improvement","name":"Improvement","color":"0052cc"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-10-20T09:32:31Z","updated_at":"2016-10-20T20:23:57Z","closed_at":null,"body":"The Jetty that is used in Druid is now almost two years old:\r\n\r\n`<jetty.version>9.2.5.v20141112</jetty.version>`\r\n\r\nThis is a problem because this version is affected by security vulnerabilities discovered in Jetty since then, such as the following one that lets an attacker access server-side memory contents from the webserver: \r\n[CVE-2015-2080](https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md)\r\n\r\nDruid should upgrade to the latest version of Jetty found here and advise customers to update their systems:\r\n[http://www.eclipse.org/jetty/download.html](http://www.eclipse.org/jetty/download.html)"},"comment":{"url":"https://api.github.com/repos/druid-io/druid/issues/comments/255217616","html_url":"https://github.com/druid-io/druid/issues/3595#issuecomment-255217616","issue_url":"https://api.github.com/repos/druid-io/druid/issues/3595","id":255217616,"user":{"login":"gianm","id":1214075,"avatar_url":"https://avatars.githubusercontent.com/u/1214075?v=3","gravatar_id":"","url":"https://api.github.com/users/gianm","html_url":"https://github.com/gianm","followers_url":"https://api.github.com/users/gianm/followers","following_url":"https://api.github.com/users/gianm/following{/other_user}","gists_url":"https://api.github.com/users/gianm/gists{/gist_id}","starred_url":"https://api.github.com/users/gianm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gianm/subscriptions","organizations_url":"https://api.github.com/users/gianm/orgs","repos_url":"https://api.github.com/users/gianm/repos","events_url":"https://api.github.com/users/gianm/events{/privacy}","received_events_url":"https://api.github.com/users/gianm/received_events","type":"User","site_admin":false},"created_at":"2016-10-20T20:23:57Z","updated_at":"2016-10-20T20:23:57Z","body":"@jmcc0nn3ll, thanks; 9.3.13.v20161014 does work when I try it locally. But we still support Java 7 in Druid- do you know if there's a 9.2.x release with everything we're looking for (the security fix[es] and the proxy fix)?"}}
{"actor":{"display_login":"gianm"}}