tunacicek
commented
10 months ago @shijinrajbosch Update changelog with new version please.
Closed shijinrajbosch closed 10 months ago
tunacicek
commented
10 months ago @shijinrajbosch Update changelog with new version please.
shijinrajbosch
commented
10 months ago @shijinrajbosch Update changelog with new version please.
Hi @tunacicek ,
Please note that the change log was updated with the CVEs fix already (with the previous PR - https://github.com/eclipse-tractusx/sldt-semantic-hub/pull/179/files ) . This PR to address the problem with previous PR.
agg3fe
commented
10 months ago @shijinrajbosch Update changelog with new version please.
Hi @tunacicek ,
Please note that the change log was updated with the CVEs fix already (with the previous PR - https://github.com/eclipse-tractusx/sldt-semantic-hub/pull/179/files ) . This PR to address the problem with previous PR.
since we created the image yesterday for the previous PR and now since we have new changes we will need to create new image and hence need to update the version again in Changelog and create new version.
sonarcloud[bot]
commented
10 months ago Kudos, SonarCloud Quality Gate passed! 
0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells
No Coverage information
0.0% Duplication
shijinrajbosch
commented
10 months ago @shijinrajbosch Update changelog with new version please.
Hi @tunacicek , Please note that the change log was updated with the CVEs fix already (with the previous PR - https://github.com/eclipse-tractusx/sldt-semantic-hub/pull/179/files ) . This PR to address the problem with previous PR.
since we created the image yesterday for the previous PR and now since we have new changes we will need to create new image and hence need to update the version again in Changelog and create new version.
Thanks @tunacicek for the clarification. I have updated the changelog accordingly.
Description
Veracode CVEs fix in jetty-http jar.
CVE-2023-36478 | CWE-190 Denial Of Service (DoS): org.eclipse.jetty is vulnerable to Denial Of Service (DoS). The vulnerability arises from the library's failure to appropriately limit the size in HPACK header values. This allows an attacker to repeatedly send maliciously crafted HTTP messages, leading to an integer overflow and ultimately causing an application crash through the
checkSizefunction inMetaDataBuilder.java.CVE-2023-40167| CWE-130 HTTP Request Smuggling: Jetty is vulnerable to HTTP Request Smuggling. The vulnerability is due to accepting
+character proceeding the content-length in the request. This vulnerability can be exploited by the attacker to possibly conduct request smuggling attacks.