[ https://issues.apache.org/jira/browse/AMBARI-23869?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
ASF GitHub Bot updated AMBARI-23869: ------------------------------------ Labels: pull-request-available (was: ) > Remove insecure dependencies from Ambari Server > ----------------------------------------------- > > Key: AMBARI-23869 > URL: https://issues.apache.org/jira/browse/AMBARI-23869 > Project: Ambari > Issue Type: Bug > Components: ambari-agent, ambari-server > Affects Versions: 2.7.0 > Reporter: Robert Levas > Assignee: Robert Levas > Priority: Critical > Labels: pull-request-available > Fix For: 2.7.0 > > > Remove insecure dependencies from Ambari Server > *Jetty: Java based HTTP, Servlet, SPDY, WebSocket Server 6.1.26* > * https://nvd.nist.gov/vuln/detail/CVE-2017-9735 > * https://nvd.nist.gov/vuln/detail/CVE-2011-4461 > * https://nvd.nist.gov/vuln/detail/CVE-2009-1523 > {noformat} > [INFO] > ------------------------------------------------------------------------ > [INFO] Building Ambari Server 2.0.0.0-SNAPSHOT > [INFO] > ------------------------------------------------------------------------ > [INFO] > [INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ ambari-server --- > [INFO] org.apache.ambari:ambari-server:jar:2.0.0.0-SNAPSHOT > [INFO] +- org.mortbay.jetty:jsp-api-2.1-glassfish:jar:2.1.v20100127:compile > [INFO] +- org.mortbay.jetty:jsp-2.1-glassfish:jar:2.1.v20100127:compile > [INFO] \- org.apache.hadoop:hadoop-common:jar:2.7.2:compile > [INFO] \- org.mortbay.jetty:jetty:jar:6.1.26:compile{noformat} > Recommendation is to remove the dependency or upgrade to version 6.1.26.hwx > or the latest version, if possible. -- This message was sent by Atlassian JIRA (v7.6.3#76005)