You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cxf.apache.org by GitBox <gi...@apache.org> on 2020/02/06 23:09:56 UTC
[GitHub] [cxf] davidkarlsen opened a new pull request #638: upgrade guava,
CVE-2018-10237
davidkarlsen opened a new pull request #638: upgrade guava, CVE-2018-10237
URL: https://github.com/apache/cxf/pull/638
Upgrade guava to avoid being marked for CVE-2018-10237 - although CXF might not directly be affected by the issue.
Signed-off-by: David Karlsen <da...@davidkarlsen.com>
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [cxf] reta commented on a change in pull request #638: upgrade
guava, CVE-2018-10237
Posted by GitBox <gi...@apache.org>.
reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237
URL: https://github.com/apache/cxf/pull/638#discussion_r376201925
##########
File path: parent/pom.xml
##########
@@ -119,7 +119,7 @@
<cxf.geronimo.transaction.version>3.1.4</cxf.geronimo.transaction.version>
<cxf.geronimo.openapi.version>1.0.12</cxf.geronimo.openapi.version>
<cxf.glassfish.json.version>1.0.4</cxf.glassfish.json.version>
- <cxf.guava.version>20.0</cxf.guava.version>
+ <cxf.guava.version>28.2-jre</cxf.guava.version>
Review comment:
@davidkarlsen Unfortunately `guava` is problematic to update :( The OSGi bundles are failing to deploy with Guava > 20.0, we need to update the affected dependencies before that:
```
[caused by: Unable to resolve org.apache.servicemix.bundles.opensaml/3.4.3.1: missing requirement [org.apache.servicemix.bundles.opensaml/3.4.3.1] osgi.wiring.package; filter:="(&(osgi.wiring.package=com.google.common.base)(version>=19.0.0)(!(version>=21.0.0)))"
```
:(
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [cxf] reta commented on a change in pull request #638: upgrade
guava, CVE-2018-10237
Posted by GitBox <gi...@apache.org>.
reta commented on a change in pull request #638: upgrade guava, CVE-2018-10237
URL: https://github.com/apache/cxf/pull/638#discussion_r376201925
##########
File path: parent/pom.xml
##########
@@ -119,7 +119,7 @@
<cxf.geronimo.transaction.version>3.1.4</cxf.geronimo.transaction.version>
<cxf.geronimo.openapi.version>1.0.12</cxf.geronimo.openapi.version>
<cxf.glassfish.json.version>1.0.4</cxf.glassfish.json.version>
- <cxf.guava.version>20.0</cxf.guava.version>
+ <cxf.guava.version>28.2-jre</cxf.guava.version>
Review comment:
@davidkarlsen Unfortunately `guava` is problematic to update :-( The OSGi bundles are failing to deploy with Guava > 20.0, we need to update the affected dependencies before that:
```
[caused by: Unable to resolve org.apache.servicemix.bundles.opensaml/3.4.3.1: missing requirement [org.apache.servicemix.bundles.opensaml/3.4.3.1] osgi.wiring.package; filter:="(&(osgi.wiring.package=com.google.common.base)(version>=19.0.0)(!(version>=21.0.0)))"
```
:-(
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [cxf] coheigea commented on a change in pull request #638: upgrade
guava, CVE-2018-10237
Posted by GitBox <gi...@apache.org>.
coheigea commented on a change in pull request #638: upgrade guava, CVE-2018-10237
URL: https://github.com/apache/cxf/pull/638#discussion_r377614476
##########
File path: parent/pom.xml
##########
@@ -119,7 +119,7 @@
<cxf.geronimo.transaction.version>3.1.4</cxf.geronimo.transaction.version>
<cxf.geronimo.openapi.version>1.0.12</cxf.geronimo.openapi.version>
<cxf.glassfish.json.version>1.0.4</cxf.glassfish.json.version>
- <cxf.guava.version>20.0</cxf.guava.version>
+ <cxf.guava.version>28.2-jre</cxf.guava.version>
Review comment:
@jbonofre - Could we have new opensaml bundles that allow a wider guava range?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services