harmadasg commented on code in PR #24017: URL: https://github.com/apache/kafka/pull/24017#discussion_r4414302125
########## docs/getting-started/upgrade.md: ########## @@ -58,6 +58,12 @@ If you are upgrading from version 2.4.0 or above, and you have not overridden th +### Notable changes in 3.9.3 + + * The broker-side OAUTHBEARER JWT validator now fails fast at startup when a JWKS endpoint (`sasl.oauthbearer.jwks.endpoint.url`) is configured but `sasl.oauthbearer.expected.audience` or `sasl.oauthbearer.expected.issuer` is not set. Brokers that previously started without these settings will now fail to start until they are configured. To intentionally accept tokens regardless of their audience or issuer, set the new `sasl.oauthbearer.allow.unverified.audience` or `sasl.oauthbearer.allow.unverified.issuer` configs (both default `false`) to `true`. Review Comment: Not sure about backporting this CVE fix due to the breaking behavior. 3.9.3 is a patch/bugfix release with backward compatible guarantees and also the original [commit](https://github.com/apache/kafka/commit/9c7fad339731199da395d90690fc62efae69615b) was never backported to any releases prior to 4.4 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
