spark-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Apache Spark (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (SPARK-14897) Upgrade Jetty to latest version of 8/9
Date Mon, 02 May 2016 18:35:12 GMT

    [ https://issues.apache.org/jira/browse/SPARK-14897?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15267226#comment-15267226
] 

Apache Spark commented on SPARK-14897:
--------------------------------------

User 'srowen' has created a pull request for this issue:
https://github.com/apache/spark/pull/12842

> Upgrade Jetty to latest version of 8/9
> --------------------------------------
>
>                 Key: SPARK-14897
>                 URL: https://issues.apache.org/jira/browse/SPARK-14897
>             Project: Spark
>          Issue Type: Improvement
>            Reporter: Adam Kramer
>              Labels: web-ui
>
> It looks like the head/master branch of Spark uses quite an old version of Jetty: 8.1.14.v20131031
> There have been some announcement of security vulnerabilities, notably in 2015 and there
are versions of both 8 and 9 that address those. We recently left a web-ui port open and had
the server compromised within days. Albeit, this upgrade shouldn't be the only security improvement
made, the current version is clearly vulnerable, as-is.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org


Mime
View raw message