You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "velagalasantosh (via GitHub)" <gi...@apache.org> on 2023/03/30 19:51:51 UTC
[GitHub] [pulsar] velagalasantosh opened a new issue, #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
velagalasantosh opened a new issue, #19973:
URL: https://github.com/apache/pulsar/issues/19973
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
For the pulsar version : 2.11.0 facing a high vulnerability CVE-2021-43045 related to packages:
- org.apache.avro:avro
- org.apache.avro:avro-protobuf
- org.yaml:snakeyaml
Below are the versions available in pulsar client.
- <avro.version>1.10.2</avro.version>
- <snakeyaml.version>1.31</snakeyaml.version>
**Maven Dependency**
<parent>
<artifactId>pulsar</artifactId>
<groupId>org.apache.pulsar</groupId>
<version>2.11.0</version>
</parent>
### Minimal reproduce step
Run the blackDuck Scan.
### What did you expect to see?
Internal Jar need to expected to fix the blackDuck issues.
### What did you see instead?
vulnerability
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on issue #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on issue #19973:
URL: https://github.com/apache/pulsar/issues/19973#issuecomment-1497004615
Closing as invalid.
This is a vulnerability report for .NET SDK. We're using the Java SDK only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun closed issue #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun closed issue #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
URL: https://github.com/apache/pulsar/issues/19973
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] velagalasantosh commented on issue #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
Posted by "velagalasantosh (via GitHub)" <gi...@apache.org>.
velagalasantosh commented on issue #19973:
URL: https://github.com/apache/pulsar/issues/19973#issuecomment-1491003577
> @velagalasantosh The linked CVE seems to be only related to C# version of Avro, right?
No, we found these vulnerability in Spring boot application ( Java)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] merlimat commented on issue #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on issue #19973:
URL: https://github.com/apache/pulsar/issues/19973#issuecomment-1491015091
I understand this is getting flagged (and it will be fixed ASAP). From a risk perspective though it wouldn't apply as a vulnerability:
<img width="949" alt="image" src="https://user-images.githubusercontent.com/62500/228973091-ee1f7ba5-7a60-4a6b-929c-358c096c58ca.png">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] merlimat commented on issue #19973: [Bug] pulsar - avro.version has a vulnerability CVE-2021-43045
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on issue #19973:
URL: https://github.com/apache/pulsar/issues/19973#issuecomment-1491001262
@velagalasantosh The linked CVE seems to be only related to C# version of Avro, right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org