You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "lhotari (via GitHub)" <gi...@apache.org> on 2023/06/01 15:37:04 UTC
[GitHub] [pulsar] lhotari opened a new pull request, #20459: [fix][security] Upgrade Guava to 32.0.0 to address CVE-2023-2976
lhotari opened a new pull request, #20459:
URL: https://github.com/apache/pulsar/pull/20459
### Motivation & Modifications
Upgrade Guava to 32.0.0 to address CVE-2023-2976
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on a diff in pull request #20459: [fix][sec] Upgrade Guava to 32.0.0 to address CVE-2023-2976
Posted by "tisonkun (via GitHub)" <gi...@apache.org>.
tisonkun commented on code in PR #20459:
URL: https://github.com/apache/pulsar/pull/20459#discussion_r1213353796
##########
buildtools/pom.xml:
##########
Review Comment:
@lhotari Can you attach a description of CVE-2023-2976? I don't find it on any advisory now.
Also, cross-post Guava 32.0.0 release note - https://github.com/google/guava/releases/tag/v32.0.0
It can introduce some imcompability changes while with a quick glance I don't think it would affect our usage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on a diff in pull request #20459: [fix][sec] Upgrade Guava to 32.0.0 to address CVE-2023-2976
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #20459:
URL: https://github.com/apache/pulsar/pull/20459#discussion_r1213402641
##########
buildtools/pom.xml:
##########
Review Comment:
similar as CVE-2020-8908
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on a diff in pull request #20459: [fix][sec] Upgrade Guava to 32.0.0 to address CVE-2023-2976
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #20459:
URL: https://github.com/apache/pulsar/pull/20459#discussion_r1213399929
##########
buildtools/pom.xml:
##########
Review Comment:
thanks. The CVE seems to be in the pipeline. There was a comment here: https://github.com/google/guava/issues/2575#issuecomment-1568529013
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on pull request #20459: [fix][sec] Upgrade Guava to 32.0.0 to address CVE-2023-2976
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #20459:
URL: https://github.com/apache/pulsar/pull/20459#issuecomment-1572360920
/pulsarbot rerun-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on a diff in pull request #20459: [fix][sec] Upgrade Guava to 32.0.0 to address CVE-2023-2976
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on code in PR #20459:
URL: https://github.com/apache/pulsar/pull/20459#discussion_r1213401739
##########
buildtools/pom.xml:
##########
Review Comment:
thanks. The CVE seems to be in the pipeline. There was a comment here: https://github.com/google/guava/issues/2575#issuecomment-1568529013
It will be available at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976 when it has been published.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari merged pull request #20459: [fix][sec] Upgrade Guava to 32.0.0 to address CVE-2023-2976
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #20459:
URL: https://github.com/apache/pulsar/pull/20459
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org