You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@calcite.apache.org by "Devaspati Krishnatri (Jira)" <ji...@apache.org> on 2023/12/27 13:59:00 UTC

[jira] [Created] (CALCITE-6181) Upgrade janino to 3.1.10

Devaspati Krishnatri created CALCITE-6181:
---------------------------------------------

             Summary: Upgrade janino to 3.1.10
                 Key: CALCITE-6181
                 URL: https://issues.apache.org/jira/browse/CALCITE-6181
             Project: Calcite
          Issue Type: Task
            Reporter: Devaspati Krishnatri


Upgrade Janino to 3.1.10 due to CVE-2023-33546

janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.

CVSSv3 Score:- 5.5(Medium)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)