You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2021/01/08 13:49:56 UTC

[GitHub] [pulsar] dlsprague opened a new issue #9151: Security vulnerability in 2.6.2 and 2.7.0 Client

dlsprague opened a new issue #9151:
URL: https://github.com/apache/pulsar/issues/9151


   Using 2.6.2 client Bouncy castle jar file, an inner jar of pulsar client has some internal transitive dependencies with 1.6.0 version of bouncy castle which is causing the HIGH vulnerabilities.
   
   Using 2.7.0 High vulnerability is removed but it has 1 CRITICAL vulnerability with the new transitive dependency jar (bcprov-ext-jdk15on-1.66.jar
   
   ![image262_1](https://user-images.githubusercontent.com/75750837/104022522-649abb00-518e-11eb-92e8-4377d76bfe92.png)
   ![image262_2](https://user-images.githubusercontent.com/75750837/104022535-68c6d880-518e-11eb-9014-0cd04764b1ea.png)
   ![image270_1](https://user-images.githubusercontent.com/75750837/104022546-6cf2f600-518e-11eb-93d4-6e94dee1b902.png)
   ![image270_2](https://user-images.githubusercontent.com/75750837/104022556-711f1380-518e-11eb-8446-89eeac32213c.png)
   
   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar] codelipenghui commented on issue #9151: Security vulnerability in 2.6.2 and 2.7.0 Client

Posted by GitBox <gi...@apache.org>.
codelipenghui commented on issue #9151:
URL: https://github.com/apache/pulsar/issues/9151#issuecomment-1058894234


   The issue had no activity for 30 days, mark with Stale label.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org