You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@arrow.apache.org by "Wes McKinney (JIRA)" <ji...@apache.org> on 2017/08/11 14:09:00 UTC
[jira] [Commented] (ARROW-1240) security: upgrade logback to
address CVE-2017-5929
[ https://issues.apache.org/jira/browse/ARROW-1240?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16123388#comment-16123388 ]
Wes McKinney commented on ARROW-1240:
-------------------------------------
Is this a problem for the 0.6.0 release, could you vote on the mailing list thread as soon as possible?
> security: upgrade logback to address CVE-2017-5929
> --------------------------------------------------
>
> Key: ARROW-1240
> URL: https://issues.apache.org/jira/browse/ARROW-1240
> Project: Apache Arrow
> Issue Type: Bug
> Components: Java - Memory, Java - Vectors
> Affects Versions: 0.4.1
> Reporter: Matt Darwin
> Assignee: Matt Darwin
> Fix For: 0.6.0
>
>
> logback versions before 1.2.0 are affected by "a rather severe serialization vulnerability in SocketServer and ServerSocketReceiver".
> We should upgrade logback from 1.0.13 to the latest version (currently 1.2.3) in order to address this.
> See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929
> and
> https://logback.qos.ch/news.html
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)