Fix CVE-2023-36479-jetty-AtomGit

已开启

Fix CVE-2023-36479 #69

AtomGit-Bot创建于 2023年12月20日从refs/pull/69/head 合入到 openEuler-22.03-LTS-SP1

Fix CVE-2023-36479 #69

已开启

AtomGit-Bot创建于 2023年12月20日

从refs/pull/69/head合入到openEuler-22.03-LTS-SP1

共 2 个文件变更+57-1

ACVE-2023-36479.patch+52-0

@@ -0,0 +1,52 @@
	1	+From ec7e1fd173481e526db4092f558aa2b5aab57580 Mon Sep 17 00:00:00 2001
	2	+From: Simone Bordet <simone.bordet@gmail.com>
	3	+Date: Thu, 8 Jun 2023 10:18:54 +0200
	4	+Subject: [PATCH] Fixes #9887 - Deprecate CGI Servlet. (#9888)
	5	+
	6	+Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
	7	+---
	8	+ .../main/java/org/eclipse/jetty/servlets/CGI.java \| 3 +++
	9	+ .../src/main/webapp/WEB-INF/web.xml \| 12 ------------
	10	+ 2 files changed, 3 insertions(+), 12 deletions(-)
	11	+
	12	+diff --git a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java
	13	+index 9236825cc0..6454540fe3 100644
	14	+--- a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java
	15	++++ b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java
	16	+@@ -67,7 +67,10 @@ import org.eclipse.jetty.util.log.Logger;
	17	+ * <dt>ignoreExitState</dt>
	18	+ * <dd>If true then do not act on a non-zero exec exit status")</dd>
	19	+ * </dl>
	20	++ *
	21	++ * @deprecated do not use, no replacement, will be removed in a future release.
	22	+ */
	23	++@Deprecated
	24	+ public class CGI extends HttpServlet
	25	+ {
	26	+ private static final long serialVersionUID = -6182088932884791074L;
	27	+diff --git a/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml b/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml
	28	+index 05e4f1d4f6..ef7e27930b 100644
	29	+--- a/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml
	30	++++ b/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml
	31	+@@ -121,18 +121,6 @@
	32	+ <url-pattern>/dispatch/*</url-pattern>
	33	+ </servlet-mapping>
	34	+
	35	+- <servlet>
	36	+- <servlet-name>CGI</servlet-name>
	37	+- <servlet-class>org.eclipse.jetty.servlets.CGI</servlet-class>
	38	+- <load-on-startup>1</load-on-startup>
	39	+- <async-supported>true</async-supported>
	40	+- </servlet>
	41	+-
	42	+- <servlet-mapping>
	43	+- <servlet-name>CGI</servlet-name>
	44	+- <url-pattern>/cgi-bin/*</url-pattern>
	45	+- </servlet-mapping>
	46	+-
	47	+ <servlet>
	48	+ <servlet-name>Chat</servlet-name>
	49	+ <servlet-class>com.acme.ChatServlet</servlet-class>
	50	+--
	51	+2.42.0.windows.2
	52	+

Mjetty.spec+5-1

	@@ -12,7 +12,7 @@
12	%bcond_with jp_minimal	12	%bcond_with jp_minimal
13	Name: jetty	13	Name: jetty
14	Version: 9.4.16	14	Version: 9.4.16
15	-Release: 3	15	+Release: 4
16	Summary: Java Webserver and Servlet Container	16	Summary: Java Webserver and Servlet Container
17	License: ASL 2.0 or EPL-1.0 or EPL-2.0	17	License: ASL 2.0 or EPL-1.0 or EPL-2.0
18	URL: http://www.eclipse.org/jetty/	18	URL: http://www.eclipse.org/jetty/
	@@ -28,6 +28,7 @@ Patch3: CVE-2021-28169.patch
28	Patch4: CVE-2021-34428.patch	28	Patch4: CVE-2021-34428.patch
29	Patch5: CVE-2022-2047.patch	29	Patch5: CVE-2022-2047.patch
30	Patch6: CVE-2022-2048.patch	30	Patch6: CVE-2022-2048.patch
		31	+Patch7: CVE-2023-36479.patch
31		32
32	BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api)	33	BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api)
33	BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)	34	BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
	@@ -788,6 +789,9 @@ exit 0
788	%license LICENSE NOTICE.txt LICENSE-MIT	789	%license LICENSE NOTICE.txt LICENSE-MIT
789		790
790	%changelog	791	%changelog
		792	+* Wed Dec 20 2023 ZileYao <yaozile@xfusion.com> - 9.4.16-4
		793	+- Fix CVE-2023-36479
		794	+
791	* Wed Dec 28 2022 jiangpeng <jiangpeng01@ncti-gba.cn> - 9.4.16-3	795	* Wed Dec 28 2022 jiangpeng <jiangpeng01@ncti-gba.cn> - 9.4.16-3
792	- Fix CVE-2022-2047 and CVE-2022-2048	796	- Fix CVE-2022-2047 and CVE-2022-2048
793		797