[
https://issues.apache.org/jira/browse/ZOOKEEPER-5075?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105204#comment-18105204
]
Dávid Paksy commented on ZOOKEEPER-5075:
----------------------------------------
Note: For older branches which support Java 8 max, we should use the jdk8
classifier of jline. The newer versions have features that only work with java
22+ and this trips up the
org.codehaus.mojo.extraenforcer.dependencies.EnforceBytecodeVersion maven
plugin with zookeeper.
See: https://github.com/apache/zookeeper/pull/2329#issuecomment-4014998831
> Upgrade jline jar to 3.30.14 or higher to fix CVE-2026-56740
> ------------------------------------------------------------
>
> Key: ZOOKEEPER-5075
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5075
> Project: ZooKeeper
> Issue Type: Improvement
> Affects Versions: 3.9.5
> Reporter: Dhoka Pramod
> Priority: Major
> Labels: pull-request-available
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Vulnerability Details:
> - CVE-2026-56740 | Severity=high | CVSS=7.5 | Fix Status=fixed in 4.2.1 | Fix
> Date=2026-07-21 02:38:43 +0000 UTC
> Summary: JLine is a Java library for handling console input. Prior to
> 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module
> does not limit the number of environment variables a client may inject via
> the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in
> TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by
> ConnectionData, allowing an unauthenticated attacker to flood unique variable
> pairs before the terminating IAC SE byte and exhaust JVM heap memory with an
> OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
> Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-56740]
> - CVE-2026-56741 | Severity=high | CVSS=7.5 | Fix Status=fixed in 4.2.1 | Fix
> Date=2026-07-21 02:38:43 +0000 UTC
> Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-56741]
> Common Fix Required:
> - fixed in 4.2.1
> Impacted Packages:
> - org.jline_jline-remote-telnet_3.25.1
> Impacted Paths:
> - /opt/bitnami/zookeeper/lib/jline-3.25.1.jar
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
