已开启
Fix CVE-2023-36479 #70
AtomGit-Bot创建于 2023年12月20日
Fix CVE-2023-36479 #70
已开启
从refs/pull/70/head合入到openEuler-22.03-LTS-SP2
共 2 个文件变更+55-1
| @@ -0,0 +1,50 @@ | |||
| 1 | +From a244a09c58b5494f48375f3a38041178893d2b4c Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Zile Yao <yaozile@xfusion.com> | ||
| 3 | +Date: Wed, 20 Dec 2023 06:29:12 -0500 | ||
| 4 | +Subject: [PATCH] cve | ||
| 5 | + | ||
| 6 | +Signed-off-by: Zile Yao <yaozile@xfusion.com> | ||
| 7 | +--- | ||
| 8 | + .../src/main/java/org/eclipse/jetty/servlets/CGI.java | 3 +++ | ||
| 9 | + .../test-jetty-webapp/src/main/webapp/WEB-INF/web.xml | 11 ----------- | ||
| 10 | + 2 files changed, 3 insertions(+), 11 deletions(-) | ||
| 11 | + | ||
| 12 | +diff --git a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java | ||
| 13 | +index 6322290..55d8f9a 100644 | ||
| 14 | +--- a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java | ||
| 15 | ++++ b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/CGI.java | ||
| 16 | +@@ -67,7 +67,10 @@ import org.eclipse.jetty.util.log.Logger; | ||
| 17 | + * <dt>ignoreExitState</dt> | ||
| 18 | + * <dd>If true then do not act on a non-zero exec exit status")</dd> | ||
| 19 | + * </dl> | ||
| 20 | ++ * | ||
| 21 | ++ * @deprecated do not use, no replacement, will be removed in a future release. | ||
| 22 | + */ | ||
| 23 | ++@Deprecated | ||
| 24 | + public class CGI extends HttpServlet | ||
| 25 | + { | ||
| 26 | + private static final long serialVersionUID = -6182088932884791074L; | ||
| 27 | +diff --git a/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml b/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml | ||
| 28 | +index 507771f..978595f 100644 | ||
| 29 | +--- a/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml | ||
| 30 | ++++ b/tests/test-webapps/test-jetty-webapp/src/main/webapp/WEB-INF/web.xml | ||
| 31 | +@@ -122,17 +122,6 @@ | ||
| 32 | + </servlet-mapping> | ||
| 33 | + | ||
| 34 | + <servlet> | ||
| 35 | +- <servlet-name>CGI</servlet-name> | ||
| 36 | +- <servlet-class>org.eclipse.jetty.servlets.CGI</servlet-class> | ||
| 37 | +- <load-on-startup>1</load-on-startup> | ||
| 38 | +- </servlet> | ||
| 39 | +- | ||
| 40 | +- <servlet-mapping> | ||
| 41 | +- <servlet-name>CGI</servlet-name> | ||
| 42 | +- <url-pattern>/cgi-bin/*</url-pattern> | ||
| 43 | +- </servlet-mapping> | ||
| 44 | +- | ||
| 45 | +- <servlet> | ||
| 46 | + <servlet-name>Chat</servlet-name> | ||
| 47 | + <servlet-class>com.acme.ChatServlet</servlet-class> | ||
| 48 | + <load-on-startup>1</load-on-startup> | ||
| 49 | +-- | ||
| 50 | +1.8.3.1 | ||
| @@ -12,7 +12,7 @@ | |||
| 12 | %bcond_with jp_minimal | 12 | %bcond_with jp_minimal |
| 13 | Name: jetty | 13 | Name: jetty |
| 14 | Version: 9.4.16 | 14 | Version: 9.4.16 |
| 15 | -Release: 4 | 15 | +Release: 5 |
| 16 | Summary: Java Webserver and Servlet Container | 16 | Summary: Java Webserver and Servlet Container |
| 17 | License: ASL 2.0 or EPL-1.0 or EPL-2.0 | 17 | License: ASL 2.0 or EPL-1.0 or EPL-2.0 |
| 18 | URL: http://www.eclipse.org/jetty/ | 18 | URL: http://www.eclipse.org/jetty/ |
| @@ -28,6 +28,7 @@ Patch3: CVE-2021-28169.patch | |||
| 28 | Patch4: CVE-2021-34428.patch | 28 | Patch4: CVE-2021-34428.patch |
| 29 | Patch5: CVE-2022-2047.patch | 29 | Patch5: CVE-2022-2047.patch |
| 30 | Patch6: CVE-2022-2048.patch | 30 | Patch6: CVE-2022-2048.patch |
| 31 | +Patch7: CVE-2023-36479.patch | ||
| 31 | 32 | ||
| 32 | BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api) < 4.0.0 | 33 | BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api) < 4.0.0 |
| 33 | BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) | 34 | BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) |
| @@ -796,6 +797,9 @@ exit 0 | |||
| 796 | %license LICENSE NOTICE.txt LICENSE-MIT | 797 | %license LICENSE NOTICE.txt LICENSE-MIT |
| 797 | 798 | ||
| 798 | %changelog | 799 | %changelog |
| 800 | +* Wed Dec 20 2023 ZileYao <yaozile@xfusion.com> - 9.4.16-5 | ||
| 801 | +- Fix CVE-2023-36479 | ||
| 802 | + | ||
| 799 | * Mon May 29 2023 yaoxin <yao_xin001@hoperun.com> - 9.4.16-4 | 803 | * Mon May 29 2023 yaoxin <yao_xin001@hoperun.com> - 9.4.16-4 |
| 800 | - Fix eclipse-jgit build failure in EBS | 804 | - Fix eclipse-jgit build failure in EBS |
| 801 | 805 | ||