You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@drill.apache.org by "James Turton (Jira)" <ji...@apache.org> on 2022/07/13 09:24:00 UTC

[jira] [Closed] (DRILL-7679) Vulnerabilities in dependency htrace-core4-4.1.0-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)

     [ https://issues.apache.org/jira/browse/DRILL-7679?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

James Turton closed DRILL-7679.
-------------------------------
    Fix Version/s: 1.20.1
       Resolution: Fixed

> Vulnerabilities in dependency htrace-core4-4.1.0-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)
> ----------------------------------------------------------------------------------------------------------------------------
>
>                 Key: DRILL-7679
>                 URL: https://issues.apache.org/jira/browse/DRILL-7679
>             Project: Apache Drill
>          Issue Type: Bug
>    Affects Versions: 1.17.0
>            Reporter: Derek Lohnes
>            Priority: Major
>             Fix For: 1.20.1
>
>
> Vulnerabilities in dependency htrace-core4-4.1.0-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)
>   
> Max CVSS Score: 9.8 (Critical)
> Total # CVEs: 20
> Note: The issue with htrace is its use of Jackson Databind.
> [https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Afasterxml&cpe_product=cpe%3A%2F%3Afasterxml%3Ajackson-databind&cpe_version=cpe%3A%2F%3Afasterxml%3Ajackson-databind%3A2.4.0]
>  
> Are these vulnerabilities exploitable from Apache Drill?
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)