You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2022/01/04 09:37:53 UTC

[GitHub] [pulsar] Shoothzj opened a new pull request #13595: Bump slf4j from 1.7.25 to 1.7.32 solve CVE-2018-8088

Shoothzj opened a new pull request #13595:
URL: https://github.com/apache/pulsar/pull/13595


   ### Motivation
   Bump slf4j to 1.7.32 solve CVE-2018-8088
   
   ### Modifications
   Bump slf4j from 1.7.25 to 1.7.32
   
   ### Documentation
   
   Check the box below or label this PR directly (if you have committer privilege).
   
   Need to update docs? 
     
   - [x] `no-need-doc` 
     
     bump dependencies, no need doc
   
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar] lhotari commented on pull request #13595: Bump slf4j from 1.7.25 to 1.7.32 solve CVE-2018-8088

Posted by GitBox <gi...@apache.org>.
lhotari commented on pull request #13595:
URL: https://github.com/apache/pulsar/pull/13595#issuecomment-1004778298


   btw. https://nvd.nist.gov/vuln/detail/CVE-2018-8088 description shows that this impacts the usage of org.slf4j.ext.EventData in the slf4j-ext module. I don't think it's used in Pulsar. It's fine to upgrade the SLF4J dependency regardless that there isn't a CVE that impacts the upgrade decision.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar] Shoothzj commented on pull request #13595: Bump slf4j from 1.7.25 to 1.7.32 solve CVE-2018-8088

Posted by GitBox <gi...@apache.org>.
Shoothzj commented on pull request #13595:
URL: https://github.com/apache/pulsar/pull/13595#issuecomment-1004733708


   /pulsarbot run-failure-checks


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [pulsar] lhotari merged pull request #13595: Bump slf4j from 1.7.25 to 1.7.32

Posted by GitBox <gi...@apache.org>.
lhotari merged pull request #13595:
URL: https://github.com/apache/pulsar/pull/13595


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org