[
https://issues.apache.org/jira/browse/ZOOKEEPER-5038?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105886#comment-18105886
]
Ivan Khanas commented on ZOOKEEPER-5038:
----------------------------------------
h3. Release note text for the jakarta.servlet migration in PR #2435, as agreed
on
h3. the pull request.
Custom AuthenticationProvider implementations that override
handleAuthentication(HttpServletRequest, byte[]) must be recompiled against
jakarta.servlet. A provider compiled against javax.servlet keeps loading,
quietly stops overriding the method, and admin server authentication starts
answering 401.
X509AuthenticationProvider.X509_CERTIFICATE_ATTRIBUTE_NAME changes value to
"jakarta.servlet.request.X509Certificate". It is a compile-time constant, so it
is inlined into consumers, which need a rebuild rather than a restart.
ReadAheadEndpoint is removed. UnifiedConnectionFactory now extends
DetectorConnectionFactory, drops its (String) constructor, and narrows
(SslContextFactory, String) to (SslContextFactory.Server, String).
I checked the first item on JDK 25. Three cases:
- recompiled with @Override present: compile error, "method does not override
or implement a method from a supertype"
- recompiled without @Override: compiles clean, no warning, and the method
stops overriding
- not recompiled: no error anywhere, the interface default runs and returns an
empty list, which Commands turns into 401
The third case is the ordinary upgrade path, and it is why this needs a note.
It does fail closed, so nobody gets in who should not, but the only trace is
"Auth Id list is empty", which says nothing about the cause.
> Upgrade Jetty to address CVE-2026-2332
> --------------------------------------
>
> Key: ZOOKEEPER-5038
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5038
> Project: ZooKeeper
> Issue Type: Task
> Components: server
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Jota Martos
> Assignee: Dávid Paksy
> Priority: Major
> Labels: pull-request-available
> Time Spent: 2h 40m
> Remaining Estimate: 0h
>
> Jetty versions lower than 9.4.60 are affected by this CVE.
> bq. Jetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer
> encoding extension values, enabling request smuggling attacks.
> You can find more information in the [security
> advisory|https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
