[GitHub] [incubator-shardingsphere] Security3rd opened a new issue #4518: Vulnerable dependencies in your project.(CVEs)

[GitBox <gi...@apache.org>]

Security3rd opened a new issue #4518: Vulnerable dependencies in your project.(CVEs)
URL: https://github.com/apache/incubator-shardingsphere/issues/4518
 
 
   Hi, I found that your project are using some vulnerable dependencies. I suggest a library update to avoid potential risks. Here is the details:
   * **Vulnerable Library Version:** mysql : mysql-connector-java : 5.1.47
     **CVE ID:** [CVE-2019-2692](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2692), [CVE-2018-3258](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3258)
     **Import Path:** sharding-core/database-time-service/pom.xml, sharding-integration-test/sharding-jdbc-test/pom.xml, sharding-transaction/sharding-transaction-2pc/sharding-transaction-xa/sharding-transaction-xa-core/pom.xml, sharding-proxy/sharding-proxy-bootstrap/pom.xml, sharding-jdbc/sharding-jdbc-core/pom.xml, sharding-jdbc/sharding-jdbc-orchestration/pom.xml
     **Suggested Safe Versions:** 8.0.16, 8.0.17, 8.0.18, 8.0.19
   * **Vulnerable Library Version:** com.h2database : h2 : 1.4.196
     **CVE ID:** [CVE-2018-10054](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10054), [CVE-2018-14335](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14335)
     **Import Path:** sharding-core/sharding-core-common/pom.xml, sharding-core/sharding-core-route/pom.xml...(The rest of the 18 paths is hidden.)
     **Suggested Safe Versions:** 1.4.198, 1.4.199, 1.4.200
   * **Vulnerable Library Version:** com.google.guava : guava : 18.0
     **CVE ID:** [CVE-2018-10237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237)
     **Import Path:** sharding-core/database-time-service/pom.xml, sharding-core/sharding-core-common/pom.xml...(The rest of the 91 paths is hidden.)
     **Suggested Safe Versions:** 24.1.1-android, 24.1.1-jre, 25.0-android, 25.0-jre, 25.1-android, 25.1-jre, 26.0-android, 26.0-jre, 27.0-android, 27.0-jre, 27.0.1-android, 27.0.1-jre, 27.1-android, 27.1-jre, 28.0-android, 28.0-jre, 28.1-android, 28.1-jre, 28.2-android, 28.2-jre
   * **Vulnerable Library Version:** org.codehaus.groovy : groovy : 2.4.5
     **CVE ID:** [CVE-2016-6814](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6814)
     **Import Path:** sharding-core/sharding-core-common/pom.xml
     **Suggested Safe Versions:** 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.8, 2.4.9, 2.5.0, 2.5.0-alpha-1, 2.5.0-beta-1, 2.5.0-beta-2, 2.5.0-beta-3, 2.5.0-rc-1, 2.5.0-rc-2, 2.5.0-rc-3, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7, 2.5.8, 2.5.9, 2.6.0-alpha-1, 2.6.0-alpha-2, 2.6.0-alpha-3, 2.6.0-alpha-4, 3.0.0, 3.0.0-alpha-1, 3.0.0-alpha-2, 3.0.0-alpha-3, 3.0.0-alpha-4, 3.0.0-beta-1, 3.0.0-beta-2, 3.0.0-beta-3, 3.0.0-rc-1, 3.0.0-rc-2, 3.0.0-rc-3, 3.0.1

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services