You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "fabriziofortino (via GitHub)" <gi...@apache.org> on 2023/09/08 15:12:08 UTC
[GitHub] [jackrabbit-oak] fabriziofortino opened a new pull request, #1110: OAK-10441: exclude snakeyaml
fabriziofortino opened a new pull request, #1110:
URL: https://github.com/apache/jackrabbit-oak/pull/1110
https://nvd.nist.gov/vuln/detail/CVE-2022-1471
snakeyaml 1.33 is vulnerable to remote code execution. A better solution would be to get rid of the es high-level client completely. This would require more time because of the changes needed to replace the bulk processor.
We can safely exclude this dependency since it's not used in our codebase.
As part of this PR, the es high-level client has been updated to the latest available version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jackrabbit.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [jackrabbit-oak] nfsantos commented on a diff in pull request #1110: OAK-10441: exclude snakeyaml
Posted by "nfsantos (via GitHub)" <gi...@apache.org>.
nfsantos commented on code in PR #1110:
URL: https://github.com/apache/jackrabbit-oak/pull/1110#discussion_r1320012804
##########
oak-search-elastic/pom.xml:
##########
@@ -33,7 +33,7 @@
<description>Oak Elasticsearch integration subproject</description>
<properties>
- <elasticsearch.hlrc.version>7.17.9</elasticsearch.hlrc.version>
+ <elasticsearch.hlrc.version>7.17.13</elasticsearch.hlrc.version>
<elasticsearch.java.client.version>8.7.0</elasticsearch.java.client.version>
Review Comment:
Maybe also upgrade this one the the latest patch release?
https://mvnrepository.com/artifact/co.elastic.clients/elasticsearch-java/8.7.1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jackrabbit.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [jackrabbit-oak] fabriziofortino merged pull request #1110: OAK-10441: exclude snakeyaml from oak-search-elastic
Posted by "fabriziofortino (via GitHub)" <gi...@apache.org>.
fabriziofortino merged PR #1110:
URL: https://github.com/apache/jackrabbit-oak/pull/1110
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@jackrabbit.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org