You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "DeerplayHub (via GitHub)" <gi...@apache.org> on 2025/12/31 08:45:18 UTC

[I] [Bug] Broker引入的Rocksdb存在高危漏洞，需要升级 RocksDB [rocketmq]

DeerplayHub opened a new issue, #9975:
URL: https://github.com/apache/rocketmq/issues/9975

   ### Before Creating the Bug Report
   
   - [x] I found a bug, not just asking a question, which should be created in [GitHub Discussions](https://github.com/apache/rocketmq/discussions).
   
   - [x] I have searched the [GitHub Issues](https://github.com/apache/rocketmq/issues) and [GitHub Discussions](https://github.com/apache/rocketmq/discussions)  of this repository and believe that this is not a duplicate.
   
   - [x] I have confirmed that this bug belongs to the current repository, not other repositories of RocketMQ.
   
   
   ### Runtime platform environment
   
   Don't care.
   
   ### RocketMQ version
   
   RocketMQ 5.x
   
   ### JDK Version
   
   Don't care.
   
   ### Describe the Bug
   
   漏洞：
   zlib 输入验证错误漏洞 | CNNVD-202310-1086 | https://github.com/advisories/GHSA-mq29-j5xf-cjwr | 超危 | 个人开发者 | https://github.com/madler/zlib/pull/843
   
   ### Steps to Reproduce
   
   Don't care.
   
   ### What Did You Expect to See?
   
   升级RocksDB内部Zlib
   
   ### What Did You See Instead?
   
   none
   
   ### Additional Context
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Critical Vulnerability in Broker's RocksDB Requires Upgrade [rocketmq]

Posted by "DeerplayHub (via GitHub)" <gi...@apache.org>.
DeerplayHub closed issue #9975: [Bug] Critical Vulnerability in Broker's RocksDB Requires Upgrade
URL: https://github.com/apache/rocketmq/issues/9975


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Broker引入的Rocksdb存在高危漏洞，需要升级 RocksDB [rocketmq]

Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on issue #9975:
URL: https://github.com/apache/rocketmq/issues/9975#issuecomment-3736713154

   我已经基于 https://github.com/apache/rocketmq-externals/tree/master/rocketmq-rocksdb 的代码在 x86 和 arm 环境进行了重新编译，但是我没有升级 win 环境的动态库。
   
   <img width="1588" height="924" alt="Image" src="https://github.com/user-attachments/assets/a1b7ea43-fdc6-4953-bbd6-dc95ca32bbbf" />


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Critical Vulnerability in Broker's RocksDB Requires Upgrade [rocketmq]

Posted by "DeerplayHub (via GitHub)" <gi...@apache.org>.
DeerplayHub commented on issue #9975:
URL: https://github.com/apache/rocketmq/issues/9975#issuecomment-3738248183

   Thanks a lot for the fix! This really helps 👍


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org