You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@zookeeper.apache.org by John Muczynski <jo...@cofense.com.INVALID> on 2025/05/08 15:02:25 UTC

CVE-2024-47535, CVE-2024-47554

I see that ZooKeeper 3.8.4  is the latest stable release.
But it has CVEs, notably the two High CVEs: CVE-2024-47535, CVE-2024-47554

  *   Solution: Upgrade commons-io:commons-io to 2.14.0
  *   Solution: Upgrade io.netty:netty-common to 4.1.115
Is there a plan to release a new “latest stable release” or an update in the 3.8.x series?

Re: CVE-2024-47535, CVE-2024-47554

Posted by Patrick Hunt <ph...@apache.org>.

I see a jira for this (or at least part? plz update appropriately), no PR
yet that i can see:
https://issues.apache.org/jira/issues/?jql=project%20%3D%20ZOOKEEPER%20AND%20text%20~%20cve%20ORDER%20BY%20created%20DESC

Regards,

Patrick

On Thu, May 8, 2025 at 8:05 AM John Muczynski
<jo...@cofense.com.invalid> wrote:

> I see that ZooKeeper 3.8.4  is the latest stable release.
> But it has CVEs, notably the two High CVEs: CVE-2024-47535, CVE-2024-47554
>
>   *   Solution: Upgrade commons-io:commons-io to 2.14.0
>   *   Solution: Upgrade io.netty:netty-common to 4.1.115
> Is there a plan to release a new “latest stable release” or an update in
> the 3.8.x series?
>
>
>