You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "nikhil-ctds (via GitHub)" <gi...@apache.org> on 2023/12/21 13:43:20 UTC
[I] [Bug] MySQL Connectors has a vulnerability CVE-2023-22102 [pulsar]
nikhil-ctds opened a new issue, #21784:
URL: https://github.com/apache/pulsar/issues/21784
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
For pulsar version: `3.1.2` on branch: `branch-3.1` facing moderate severity [CVE-2023-22102](https://nvd.nist.gov/vuln/detail/CVE-2023-22102#range-9716778), related to packages:
- mysql:mysql-connector-java
Below is the versions available in pulsar -
- <mysql-jdbc.version>8.0.11</mysql-jdbc.version>
- <debezium.mysql.version>8.0.30</debezium.mysql.version>
Maven Dependency
- pulsar - org.apache.pulsar 3.1.2
### Minimal reproduce step
Run Pulsar CI workflow on pulsar branch - `branch-3.1`
### What did you expect to see?
Expected to pass the `OWASP dependency check` under `Pulsar CI` workflow.
### What did you see instead?
Vulnerability
```
Error: Failed to execute goal org.owasp:dependency-check-maven:8.2.1:aggregate (default) on project pulsar:
Error:
Error: One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
Error:
Error: mysql-connector-java-8.0.30.jar: CVE-2023-22102(8.3)
```
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] MySQL Connectors has a vulnerability CVE-2023-22102 [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat closed issue #21784: [Bug] MySQL Connectors has a vulnerability CVE-2023-22102
URL: https://github.com/apache/pulsar/issues/21784
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] MySQL Connectors has a vulnerability CVE-2023-22102 [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on issue #21784:
URL: https://github.com/apache/pulsar/issues/21784#issuecomment-6377093476
Thanks @nikhil-ctds for the report. CVE-2023-22102 was addressed by upgrading the MySQL connector to 8.0.33 in https://github.com/apache/pulsar/pull/24532 (released in 4.0.7 and 3.0.14). The connectors have since moved to apache/pulsar-connectors in PIP-465, which uses mysql-connector-j 9.4.0. 3.1 is no longer supported, so closing as fixed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org