spark-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Sean Owen (JIRA)" <j...@apache.org>
Subject [jira] [Resolved] (SPARK-14897) Upgrade Jetty to latest version of 8/9
Date Thu, 12 May 2016 19:08:12 GMT

     [ https://issues.apache.org/jira/browse/SPARK-14897?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Sean Owen resolved SPARK-14897.
-------------------------------
       Resolution: Fixed
    Fix Version/s: 2.0.0

Issue resolved by pull request 12916
[https://github.com/apache/spark/pull/12916]

> Upgrade Jetty to latest version of 8/9
> --------------------------------------
>
>                 Key: SPARK-14897
>                 URL: https://issues.apache.org/jira/browse/SPARK-14897
>             Project: Spark
>          Issue Type: Improvement
>            Reporter: Adam Kramer
>              Labels: web-ui
>             Fix For: 2.0.0
>
>
> It looks like the head/master branch of Spark uses quite an old version of Jetty: 8.1.14.v20131031
> There have been some announcement of security vulnerabilities, notably in 2015 and there
are versions of both 8 and 9 that address those. We recently left a web-ui port open and had
the server compromised within days. Albeit, this upgrade shouldn't be the only security improvement
made, the current version is clearly vulnerable, as-is.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org


Mime
View raw message