Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

alpn-api vulnerability

See original GitHub issue

The following dependency:

lazy val alpn_api = "org.eclipse.jetty.alpn" % "alpn-api" % "1.1.3.v20160715"

Is subject to this vulnerability: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7656

Whatever this means, we can’t use http4s in my company because of a requirement to have a OWASP score lower than 3.9.

Anyway to drop this library?

Thanks

Issue Analytics

State:
Created 5 years ago
Comments:6 (2 by maintainers)

Top GitHub Comments

1reaction

sbordetcommented, Oct 4, 2018

I’m the org.eclipse.jetty.alpn author.

@joan38 vulnerability CVE-2017-7656 has been addressed here: https://www.eclipse.org/lists/jetty-announce/msg00123.html.

One thing is the Jetty server itself, and another thing are jars of libraries that happen to have the same or a similar groupId as in org.eclipse.jetty.

CVE-2017-7656 is about a behavior in the Jetty HTTP parser, so org.eclipse.jetty.alpn is completely unaffected by it - I guess the vulnerability tools got confused.

1reaction

rossabakercommented, Oct 4, 2018

Ooh, neat. I did not know about that plugin. That would be a great thing to add to blaze and http4s repos. With this exception, of course.

Thanks for the report!

Top Results From Across the Web

ALPACA – the wacky TLS security vulnerability with a funky ...

The good news is that ALPACA isn't a terribly usable attack, and there are some fairly simple ways to ensure it doesn't happen...

undertow-core » 2.2.13.Final - Maven Repository

Vulnerabilities, Direct vulnerabilities: ... Vulnerabilities from dependencies: ... org.eclipse.jetty.alpn » alpn-api · 1.1.3.v20160715, ✓. LGPL 2.1, logo ...

6.0.6 - Open source components in Digital Access component

License name Component Version Apache 1.1 bcpg‑jdk15on 1.51 Apache 1.1 commons‑discovery 0.2 Apache 1.1 commons‑fileupload 1.0

org.eclipse.jetty.http2 : http2-server : 9.4.47.v20220610

Jetty :: HTTP2 :: Server · org.eclipse.jetty.http2:http2-common · org.eclipse.jetty:jetty-server · org.eclipse.jetty.alpn:alpn-api · org.eclipse.jetty:jetty-servlet ...

Jetty : The Definitive Reference - Eclipse

This can be vulnerable to denial of service (DOS) attacks since ... hosted at Maven coordinates org.eclipse.jetty.alpn:alpn-api .