You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "compuguy (via GitHub)" <gi...@apache.org> on 2023/10/27 21:14:25 UTC
[I] [Security] 3.0.2-candidate-2 has 3 fixable security vulnerabilities [pulsar]
compuguy opened a new issue, #21457:
URL: https://github.com/apache/pulsar/issues/21457
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Version
v3.0.2-candidate-2
### Minimal reproduce step
Used a container security scanner included with Red Hat Advanced Cluster Security for Kubernetes, Stackrox Scanner.
### What did you expect to see?
Vulnerablities that should of been fixed in 3.0.2 are showing up with the included version of Trinio.
### What did you see instead?
- 3 Vulnerabilities that can be fixed
CVE-2021-42550 - https://nvd.nist.gov/vuln/detail/CVE-2021-42550
CVE-2023-0833 - https://nvd.nist.gov/vuln/detail/CVE-2023-0833
CVE-2023-3635 - Okio (1.17.2) - https://nvd.nist.gov/vuln/detail/CVE-2023-3635
- 1 of them maybe a false positive:
CVE-2023-4586 - Netty, Hot Rod client - https://nvd.nist.gov/vuln/detail/CVE-2023-4586
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Security] 3.0.2 and 3.1.1 has 3 fixable security vulnerabilities [pulsar]
Posted by "Technoboy- (via GitHub)" <gi...@apache.org>.
Technoboy- commented on issue #21457:
URL: https://github.com/apache/pulsar/issues/21457#issuecomment-1784782447
I will try to upgrade and test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Security] 3.0.2 and 3.1.1 has 2 fixable security vulnerabilities. [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on issue #21457:
URL: https://github.com/apache/pulsar/issues/21457#issuecomment-6376819998
Thanks @compuguy for the report. The flagged libraries came from the bundled Trino (Pulsar SQL) distribution, which #21795 removed from the Pulsar distribution starting with 3.2.0. Current master no longer ships Trino, and the Okio it does ship comes from another dependency and is version 3.18.1. Closing this as no longer applicable. If a scanner still reports these on a currently supported release, please open a new issue with the image tag and the scanner output.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Security] 3.0.2 and 3.1.1 has 3 fixable security vulnerabilities [pulsar]
Posted by "compuguy (via GitHub)" <gi...@apache.org>.
compuguy commented on issue #21457:
URL: https://github.com/apache/pulsar/issues/21457#issuecomment-1869744630
Just to update this issue, I'm not sure if CVE-2023-0833 is related to Pulsar. It mentions a vulnerability with Red Hat's AMQ-Streams,....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Security] 3.0.2 and 3.1.1 has 2 fixable security vulnerabilities. [pulsar]
Posted by "anujkumar93 (via GitHub)" <gi...@apache.org>.
anujkumar93 commented on issue #21457:
URL: https://github.com/apache/pulsar/issues/21457#issuecomment-2892609993
just a gentle ping here, seeing if CVE-2023-3635 has been fixed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Security] 3.0.2 and 3.1.1 has 2 fixable security vulnerabilities. [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat closed issue #21457: [Security] 3.0.2 and 3.1.1 has 2 fixable security vulnerabilities.
URL: https://github.com/apache/pulsar/issues/21457
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org