You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "Zsihovszki Krisztina (Jira)" <ji...@apache.org> on 2024/08/02 13:48:00 UTC
[jira] [Updated] (NIFI-13623) Bump gcp.sdk.version to 26.40.0 for nifi-property-protection-gcp
[ https://issues.apache.org/jira/browse/NIFI-13623?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Zsihovszki Krisztina updated NIFI-13623:
----------------------------------------
Description:
Applies to 1.x support branch.
Upgrade to 26.40.0+, to fix the following CVEs, caused by threetenbp 1.6.8:
* CVE-2024-23082
* CVE-2024-2308
NIFI-13573 fixed the same CVEs in nifi-gcp-bundle, the CVEs have to be fixed for nifi-property-protection-gcp as well.
Suppression list needs to be extended with threeten since CVE-2024-23081 and CVE-2024-23082 are still shown as vulnerability after the version upgrade.
(This suppression is also included in NiFi 2.x, main branch [https://github.com/apache/nifi/blob/main/nifi-dependency-check-maven/suppressions.xml#L268]).
was:
Applies to 1.x support branch.
Upgrade to 26.40.0+, to fix the following CVEs, caused by threetenbp 1.6.8:
* CVE-2024-23082
* CVE-2024-2308
NIFI-13573 fixed the same CVEs in nifi-gcp-bundle, the CVEs have to be fixed for
Suppression list needs to be extended with threeten since CVE-2024-23081 and CVE-2024-23082 are still shown as vulnerability after the version upgrade.
(This suppression is also included in NiFi 2.x, main branch [https://github.com/apache/nifi/blob/main/nifi-dependency-check-maven/suppressions.xml#L268]).
> Bump gcp.sdk.version to 26.40.0 for nifi-property-protection-gcp
> ----------------------------------------------------------------
>
> Key: NIFI-13623
> URL: https://issues.apache.org/jira/browse/NIFI-13623
> Project: Apache NiFi
> Issue Type: Task
> Affects Versions: 1.28.0
> Reporter: Zsihovszki Krisztina
> Assignee: Zsihovszki Krisztina
> Priority: Major
>
> Applies to 1.x support branch.
> Upgrade to 26.40.0+, to fix the following CVEs, caused by threetenbp 1.6.8:
> * CVE-2024-23082
> * CVE-2024-2308
>
> NIFI-13573 fixed the same CVEs in nifi-gcp-bundle, the CVEs have to be fixed for nifi-property-protection-gcp as well.
> Suppression list needs to be extended with threeten since CVE-2024-23081 and CVE-2024-23082 are still shown as vulnerability after the version upgrade.
> (This suppression is also included in NiFi 2.x, main branch [https://github.com/apache/nifi/blob/main/nifi-dependency-check-maven/suppressions.xml#L268]).
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)