OPSC-17995 Upgrade commons-compress 1.10 -> 1.27.1 to fix CVEs, bump version to 2.7.0.13 - #18
Open
orion104 wants to merge 62 commits into
Open
OPSC-17995 Upgrade commons-compress 1.10 -> 1.27.1 to fix CVEs, bump version to 2.7.0.13#18orion104 wants to merge 62 commits into
orion104 wants to merge 62 commits into
Conversation
Account for IPV6 in hostname stuff
Don't cause deadlocks closing sockets.
Fixes two somewhat related issues with respect to closing sockets: * Peer closes do not mean the socket is no longer writable, just that the peer has closed its half of the channel (half-closed). Fixed by always allowing the channel to be written to once half closed (#2470). * Server sockets now shutdown their thread pools asynchronously with their closing, so as to not deadlock (#2471).
…pletes #2471 Although adding the corresponding listener can produces noisy tests (in test_socket) due to finalization racing with thread pool shutdown, it also ensures these thread pools are in fact cleaned up. See netty/netty#2166 - perhaps we can control logging to remove this noise in stderr.
Add ability to deploy to artifactory
…o we can know if they failed
…nce. Fixes #2469 Jython accommodates jar shading by attempting to import packages first from shaded namespaces (via Jar Jar Links); then the usual namespace. In general, we prefer our bundled packages to prevent versioning issues, however for BC this does not work, because Java security providers (or at least BC as the relevant example) require signed jars, which breaks the shading model. Given that BC is especially stable in its API, this should (hopefully) not present an issue for Jython.
2500 - fix cacert loading
8851 patch always sync
This reverts commit 3d2cbb4.
This reverts commit fe93c03.
Netty upgrade 2
Limit send buffer to 8192
…y cert in the pem file. Workarounds issue #2516
9477 - Fix static path issue
12032 - Improve TLS errors during handshakes
Fix options so they actually work, set hard defaults
add shaded jar
* Add explicit namespace to org.python.jnr imports * Version bump
…version to 2.7.0.13
… to skip antlr_gen
NoVerifyX509TrustManager was removed by the SNI commit (f6ee772) but ripcord 6.8.x SslUtils.py still imports it. Reverting until SNI support is properly integrated as part of OPSC-16690.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the issue
Customer (Equifax) reported 5 CVEs in OpsCenter caused by the
commons-compress 1.10jar bundled insidejython-standalone, tracked in OPSC-17995.Because commons-compress is embedded inside the jython-standalone fat jar, it cannot be excluded via Gradle. The fix requires rebuilding jython-standalone with an updated commons-compress version and publishing a new artifact.
What does this PR fix and why was it fixed
commons-compressfrom 1.10 → 1.27.1 (resolves all 5 reported CVEs, well past the required minimum of 1.21)The new
2.7.0.13artifact is consumed by riptano/ripcord in the companion PR for OPSC-17995.