reporting vulnerabilities in dependencies

[stealthrabbi]

I am looking to integrate this library in to my application that I scan with trivy. Trivy has reported some vulns with the jetty libraries that are included. I'm on Javalin 4.6.3.

Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
+--------------------------------+------------------+----------+-------------------+--------------------------+--------------------------------------+
|            LIBRARY             | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |      FIXED VERSION       |                TITLE                 |
+--------------------------------+------------------+----------+-------------------+--------------------------+--------------------------------------+
| org.eclipse.jetty:jetty-http   | CVE-2022-2047    | LOW      | 9.4.46.v20220331  | 11.0.10, 10.0.10, 9.4.47 | Invalid URI parsing may produce      |
| (ipsummarizer.jar)             |                  |          |                   |                          | invalid HttpURI.authority            |
|                                |                  |          |                   |                          | -->avd.aquasec.com/nvd/cve-2022-2047 |
+--------------------------------+------------------+----------+                   +--------------------------+--------------------------------------+
| org.eclipse.jetty:jetty-server | CVE-2022-2191    | HIGH     |                   | 11.0.10, 10.0.10         | SslConnection does not release       |
| (ipsummarizer.jar)             |                  |          |                   |                          | pooled ByteBuffers in case of errors |
|                                |                  |          |                   |                          | -->avd.aquasec.com/nvd/cve-2022-2191 |
+--------------------------------+------------------+----------+-------------------+--------------------------+--------------------------------------+

[tipsy]

Thanks @stealthrabbi ! We have upgraded Jetty in Javalin 4.6.4, which was released earlier today :)

[stealthrabbi]

Ah ok thanks. 4.6.3 is still showing as the latest on maven central. Does it take time to push up?

https://mvnrepository.com/artifact/io.javalin/javalin

[tipsy]

Yes, it usually takes a few hours. mvnrepository is actually not the official page, https://search.maven.org is. You can find the artifact here: https://search.maven.org/artifact/io.javalin/javalin/4.6.4/jar, but it's also not searchable there yet.

[ajsutton]

I've pulled in Javalin 4.6.4 which is using Jetty 9.4.48.v20220622 but I'm still getting the same high priority warning for CVE-2022-2191.

Notably support for Jetty 9.4 was dropped on June 1st (jetty/jetty.project#7958). I may have missed it but I don't see a fix for CVE-2022-2191 in the 9.4 branch.

[Playacem]

@ajsutton 9.4.x is not affected. See here: jetty/jetty.project#8161

[ajsutton]

@Playacem Thank you - the CVE has the wrong versions and I hadn't seen the comments at the bottom of the PR.