[
https://issues.apache.org/jira/browse/NUTCH-3232?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138897#comment-18138897
]
ASF GitHub Bot commented on NUTCH-3232:
---------------------------------------
lewismc commented on PR #986:
URL: https://github.com/apache/nutch/pull/986#issuecomment-6663740169
A fairly obscure issue I found was `NOTICE-binary` still pointing to OkHttp
and Okio at square.github.io / github.com/square/okio. The 5.5.1 POM homepage
is https://lysine.dev/okhttp/ and the SCM is lysine-dev/okhttp (Commonhaus
move, called out in the 5.5.0 notes). We can likely address this when we ship
the next Nutch release as that file gets updated in the release management
process.
> Upgrade OkHttp to 5.5.1
> -----------------------
>
> Key: NUTCH-3232
> URL: https://issues.apache.org/jira/browse/NUTCH-3232
> Project: Nutch
> Issue Type: Improvement
> Components: plugin, protocol
> Affects Versions: 1.23
> Reporter: Hande Celikkanat
> Priority: Major
>
> Upgrade the OkHttp dependencies of protocol-okhttp (okhttp, okhttp-brotli,
> okhttp-zstd) from 5.4.0 to 5.5.1. This also upgrades Okio from 3.17.0 to
> 3.18.1.
> Notable changes since 5.4.0 (https://lysine.dev/okhttp/changelogs/changelog/):
> - 5.5.1 blocks 8 compromised eMudhra intermediate certificates
> (CVE-2026-111943).
> - 5.5.0 makes the default hostname verifier reject hosts that fail IP
> canonicalization.
> Note: OkHttp 5.5.1 applies the blocklist after hostname verification and
> independently of the trust manager, so protocol-okhttp rejects servers
> presenting one of the blocked certificates even when
> http.tls.certificates.check is false. The hostname verifier change in 5.5.0
> applies when http.tls.certificates.check is true, which is the default since
> NUTCH-3221.
> Behavior change, checked against a test server from the disclosure site that
> presents one of the blocked certificates, with certificate checks disabled
> (http.tls.certificates.check=false, the default before NUTCH-3221):
> {noformat}
> bin/nutch parsechecker -Dhttp.agent.name=test-crawler \
> -Dhttp.tls.certificates.check=false \
> -Dplugin.includes='protocol-okhttp|parse-(html|tika)'
> https://dv-g3b-emudhra.we-have-a-problem.com/
> {noformat}
> OkHttp 5.4.0 (master):
> {noformat}
> Status: success(1,0)
> {noformat}
> OkHttp 5.5.1 (this change):
> {noformat}
> Fetch failed with protocol status: exception(16), lastModified=0:
> javax.net.ssl.SSLPeerUnverifiedException: Hostname
> dv-g3b-emudhra.we-have-a-problem.com not verified (blocklisted by OkHttp)
> {noformat}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
