From 612396cba2e48029d42bcc38d5355dfcbce09dd8 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Thu, 17 Oct 2024 18:39:32 +0300
Subject: [PATCH] CVE-2024-8184 Eclipse Jetty's ThreadLimitHandler.getRemote()
 vulnerable to remote DoS attacks

---
 OpenICF-groovy-connector/pom.xml               |  3 ++-
 .../connector-server-jetty/pom.xml             |  6 ++----
 pom.xml                                        | 18 ++++++++++++++++++
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/OpenICF-groovy-connector/pom.xml b/OpenICF-groovy-connector/pom.xml
index 88e2ee63..f0e41062 100644
--- a/OpenICF-groovy-connector/pom.xml
+++ b/OpenICF-groovy-connector/pom.xml
@@ -21,6 +21,8 @@
  with the fields enclosed by brackets [] replaced by
  your own identifying information:
  "Portions Copyrighted [year] [name of copyright owner]"
+
+ Portions Copyrighted 2018-2024 3A Systems, LLC
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
@@ -187,7 +189,6 @@
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
-            <version>9.4.51.v20230217</version>
             <scope>test</scope>
         </dependency>
 
diff --git a/OpenICF-java-framework/connector-server-jetty/pom.xml b/OpenICF-java-framework/connector-server-jetty/pom.xml
index d9472c20..e8e42705 100644
--- a/OpenICF-java-framework/connector-server-jetty/pom.xml
+++ b/OpenICF-java-framework/connector-server-jetty/pom.xml
@@ -21,6 +21,8 @@
  with the fields enclosed by brackets [] replaced by
  your own identifying information:
  "Portions Copyrighted [year] [name of copyright owner]"
+
+  Portions Copyrighted 2018-2024 3A Systems, LLC
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <parent>
@@ -38,7 +40,6 @@
     </description>
 
     <properties>
-        <jetty.version>9.4.55.v20240627</jetty.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     </properties>
 
@@ -51,7 +52,6 @@
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
             <artifactId>websocket-server</artifactId>
-            <version>${jetty.version}</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -100,13 +100,11 @@
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-servlet</artifactId>
-            <version>${jetty.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
-            <version>${jetty.version}</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/pom.xml b/pom.xml
index 19e7d40f..f504a3ef 100644
--- a/pom.xml
+++ b/pom.xml
@@ -305,6 +305,24 @@
                 <version>1.2.0</version>
                 <scope>test</scope>
             </dependency>
+            <dependency>
+                <groupId>org.eclipse.jetty</groupId>
+                <artifactId>jetty-servlet</artifactId>
+                <version>9.4.56.v20240826</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.eclipse.jetty</groupId>
+                <artifactId>jetty-server</artifactId>
+                <version>9.4.56.v20240826</version>
+                <scope>test</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.eclipse.jetty.websocket</groupId>
+                <artifactId>websocket-server</artifactId>
+                <version>9.4.56.v20240826</version>
+                <scope>provided</scope>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <build>