[jira] [Comment Edited] (IGNITE-9900) Upgrade annotations.jar to a new version

["Stanislav Lukyanov (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/IGNITE-9900?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16653301#comment-16653301 ] 

Stanislav Lukyanov edited comment on IGNITE-9900 at 10/17/18 10:16 AM:
-----------------------------------------------------------------------

On the blocker from TC bot: Hadoop fails with all kinds of issues this days, and upgrading annotations.jar version couldn't possibly break it more.


was (Author: slukyanov):
On the blocker fromm TC bot: Hadoop fails with all kinds of issues this days, and upgrading annotations.jar version couldn't possibly break it more.

> Upgrade annotations.jar to a new version
> ----------------------------------------
>
>                 Key: IGNITE-9900
>                 URL: https://issues.apache.org/jira/browse/IGNITE-9900
>             Project: Ignite
>          Issue Type: Improvement
>            Reporter: Stanislav Lukyanov
>            Assignee: Stanislav Lukyanov
>            Priority: Major
>
> OWASP Dependency Check reports that annotations.jar of version 13.0 is affected by vulnerability CVE-2017-8316,
> while it obviously isn't (the CVE is about XXE attack, and annotations.jar is, well, annotations).
> The issue is that NVD database only says that "intellij_idea" is affected, and OWASP doesn't know better than to map annotations.jar to the intellij_idea product.
> While the problem could be (and perhaps will be, see https://youtrack.jetbrains.com/issue/IDEA-200601) sorted out on the level of OWASP and NVD, the easiest way to workaround this is to upgrade annotations.jar to a new version (currently 16.0.3). It will help Ignite users to avoid annoying false-positive warnings from OWASP.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)