You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "nikhil-ctds (via GitHub)" <gi...@apache.org> on 2023/12/21 13:22:15 UTC
[I] [Bug] Elasticsearch Java version has a vulnerability CVE-2023-46673, CVE-2023-46674, CVE-2023-31419, CVE-2023-31417, CVE-2023-31418 [pulsar]
nikhil-ctds opened a new issue, #21782:
URL: https://github.com/apache/pulsar/issues/21782
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
For pulsar version: `3.1.2` on branch: `branch-3.1` facing moderate severity
[CVE-2023-46673](https://github.com/advisories/GHSA-285m-vhfq-xx4h), [CVE-2023-46674](https://github.com/advisories/GHSA-rv74-m283-5j95), [CVE-2023-31419](https://github.com/advisories/GHSA-qwrx-45xf-jjf7), [CVE-2023-31417](https://github.com/advisories/GHSA-99pc-69q9-jxf2), [CVE-2023-31418](https://github.com/advisories/GHSA-2cqf-6xv9-f22w), related to packages:
- org.elasticsearch:elasticsearch
- org.elasticsearch:elasticsearch-hadoop
- co.elastic.clients:elasticsearch-java
Below is the versions available in pulsar -
- <elasticsearch-java.version>8.5.2</elasticsearch-java.version>
Maven Dependency
- pulsar - org.apache.pulsar 3.1.2
### Minimal reproduce step
Run Pulsar CI workflow on pulsar branch - `branch-3.1`
### What did you expect to see?
Expected to pass the `OWASP dependency check` under `Pulsar CI` workflow.
### What did you see instead?
Vulnerability
```
Error: Failed to execute goal org.owasp:dependency-check-maven:8.2.1:aggregate (default) on project pulsar:
Error:
Error: One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
Error:
Error: elasticsearch-java-8.5.2.jar: CVE-2023-46673(7.5), CVE-2023-46674(7.8), CVE-2023-31419(7.5), CVE-2023-31417(7.5), CVE-2023-31418(7.5)
Error: elasticsearch-rest-client-8.5.2.jar: CVE-2023-46673(7.5), CVE-2023-46674(7.8), CVE-2023-31419(7.5), CVE-2023-31417(7.5), CVE-2023-31418(7.5)
```
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Elasticsearch Java version has a vulnerability CVE-2023-46673, CVE-2023-46674, CVE-2023-31419, CVE-2023-31417, CVE-2023-31418 [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on issue #21782:
URL: https://github.com/apache/pulsar/issues/21782#issuecomment-6376818327
Thanks @nikhil-ctds for reporting this. The Elasticsearch connector, and the elasticsearch-java dependency with it, is no longer part of this repository: #25408 (PIP-465) moved the IO connectors to apache/pulsar-connectors. Before that, #22640 upgraded elasticsearch-java to 8.12.1. Branch 3.1, where this was reported, is no longer supported. Closing this; if the dependency is still flagged on a currently supported release, please open an issue in apache/pulsar-connectors, or a new issue here for the supported branch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Elasticsearch Java version has a vulnerability CVE-2023-46673, CVE-2023-46674, CVE-2023-31419, CVE-2023-31417, CVE-2023-31418 [pulsar]
Posted by "hpvd (via GitHub)" <gi...@apache.org>.
hpvd commented on issue #21782:
URL: https://github.com/apache/pulsar/issues/21782#issuecomment-2101572900
see also ongoing discussion https://github.com/apache/pulsar/discussions/19093#discussioncomment-9360551
and upvote it if you also think this is important.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] Elasticsearch Java version has a vulnerability CVE-2023-46673, CVE-2023-46674, CVE-2023-31419, CVE-2023-31417, CVE-2023-31418 [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat closed issue #21782: [Bug] Elasticsearch Java version has a vulnerability CVE-2023-46673, CVE-2023-46674, CVE-2023-31419, CVE-2023-31417, CVE-2023-31418
URL: https://github.com/apache/pulsar/issues/21782
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org