CODEWITHSUNDEEP
javasecuritywebsocketjettycve
gstackoverflow
gstackoverflow

Reputation: 37034

How to get rid of critical vulnerabilities of jetty-websocket ? (CVE-2017-7657 CVE-2017-7658)

I am working on the fork of guacamole-client

I(and also original project) has depedency:

   <!-- Jetty 8 servlet API (websocket)  -->
    <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>jetty-websocket</artifactId>
        <version>8.1.1.v20120215</version>
        <scope>provided</scope>
    </dependency>

Based on result of security analyzer this dependency has 2 critical vulnurabilities:

Based on https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-websocket/8.1.1.v20120215 enter image description here

This vulnerabilities come from its dependencies:

Looks like those vulnerabilities are taken from:

org.eclipse.jetty » jetty-server » 8.1.1.v20120215

enter image description here

I see that the latest version of jetty-websocket is 8.2.0.v20160908 but it was released in 2016 and it still contains this issue because it references jetty-server 8.2.0.v20160908

Those vulnerabilities are fixed in jetty-server » 9.3.24.v20180605

but there are no correspondng version of jetty-websocket so I have no idea how can I fix this issue.

Is there way to get rid of those vunerabilities ?

P.S.

I have imports:

import org.eclipse.jetty.websocket.WebSocket;
import org.eclipse.jetty.websocket.WebSocket.Connection;
import org.eclipse.jetty.websocket.WebSocketServlet;

What do I have to replace them with ?

Upvotes: 1

Views: 153

Answers (1)

Joakim Erdfelt
Joakim Erdfelt

Reputation: 49452

  • Jetty 8 was EOL back in 2014.
  • Jetty 9 went EOL in 2022.
  • Jetty 10 and Jetty 11 went EOL in 2024.

The only version supported right now is Jetty 12. - https://jetty.org/download.html#what-version-do-i-use

If you need support for the old javax.servlet namespace, use the ee8 environment in Jetty 12.

Note that WebSocket has undergone large changes since Jetty 8.

  • The Jetty 8 implementation of WebSocket was back when WebSocket was still a draft spec.
  • Jetty 9 made changes to support the released WebSocket spec. (and the original jetty-websocket artifact was split up)
  • Jetty 10 made changes to support WebSocket on HTTP/2 (and more splits in the websocket artifacts were made)
  • Jetty 12 made changes to support WebSocket on any protocol (even oddball ones like UnixSocket) (and even more websocket artifacts were made)

These changes also changed the maven coordinates.

See the migration guides for coordinate changes.

Upvotes: 1

Related Questions