You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ignite.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2018/10/16 12:51:00 UTC
[jira] [Commented] (IGNITE-9900) Upgrade annotations.jar to a new
version
[ https://issues.apache.org/jira/browse/IGNITE-9900?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16651623#comment-16651623 ]
ASF GitHub Bot commented on IGNITE-9900:
----------------------------------------
GitHub user slukyano opened a pull request:
https://github.com/apache/ignite/pull/5004
IGNITE-9900: Upgrade annotations.jar to a new version.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/gridgain/apache-ignite ignite-9900
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/ignite/pull/5004.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #5004
----
commit 2e9e6a3a21a117ca9a9ef2864f9e7e1541746388
Author: Stanislav Lukyanov <st...@...>
Date: 2018-10-16T12:29:38Z
IGNITE-9900: Upgrade annotations.jar to a new version.
----
> Upgrade annotations.jar to a new version
> ----------------------------------------
>
> Key: IGNITE-9900
> URL: https://issues.apache.org/jira/browse/IGNITE-9900
> Project: Ignite
> Issue Type: Improvement
> Reporter: Stanislav Lukyanov
> Assignee: Stanislav Lukyanov
> Priority: Major
>
> OWASP Dependency Check reports that annotations.jar of version 13.0 is affected by vulnerability CVE-2017-8316,
> while it obviously isn't (the CVE is about XXE attack, and annotations.jar is, well, annotations).
> The issue is that NVD database only says that "intellij_idea" is affected, and OWASP doesn't know better than to map annotations.jar to the intellij_idea product.
> While the problem could be (and perhaps will be, see https://youtrack.jetbrains.com/issue/IDEA-200601) sorted out on the level of OWASP and NVD, the easiest way to workaround this is to upgrade annotations.jar to a new version (currently 16.0.3). It will help Ignite users to avoid annoying false-positive warnings from OWASP.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)