omkreddy commented on code in PR #24017: URL: https://github.com/apache/kafka/pull/24017#discussion_r4415025892
########## docs/getting-started/upgrade.md: ########## @@ -58,6 +58,12 @@ If you are upgrading from version 2.4.0 or above, and you have not overridden th +### Notable changes in 3.9.3 + + * The broker-side OAUTHBEARER JWT validator now fails fast at startup when a JWKS endpoint (`sasl.oauthbearer.jwks.endpoint.url`) is configured but `sasl.oauthbearer.expected.audience` or `sasl.oauthbearer.expected.issuer` is not set. Brokers that previously started without these settings will now fail to start until they are configured. To intentionally accept tokens regardless of their audience or issuer, set the new `sasl.oauthbearer.allow.unverified.audience` or `sasl.oauthbearer.allow.unverified.issuer` configs (both default `false`) to `true`. Review Comment: I think we can skip this CVE, as this is a hardening fix starting from 4.4 onwards. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
