CVE 2024 52577: Ignite patched version Java 8 compatible

[Nicolas Garcin <ni...@neoxam.com.INVALID>]

Hi Ignite,

Question regarding CVE‑2024‑52577 affecting Ignite < 2.17 : we managed to smoothly upgrade to Ignite 2.17 in the latest version of our software to get rid of this vuln, but some of our clients are still using an older version of our software with Ignite 2.14. This version of our software is built and run with Java 8 and it’s not possible to upgrade Java on this version. Therefore, we cannot upgrade Ignite to 2.17. Any chance to get an Ignite version compatible with Java 8 that fixes CVE‑2024‑52577 ? Thanks for your input.

Regards,
Nicolas

Re: CVE 2024 52577: Ignite patched version Java 8 compatible

[Stephen Darlington <sd...@apache.org>]

The community really only supports the current version. Of course, Ignite
is open source so you could back-port the fix yourself. It looks like quite
a large patch, so I'm not clear how easy it would be to backport and test.
There are commercial options available if you search around.

Regards,
Stephen


On Thu, 26 Jun 2025 at 13:33, Nicolas Garcin
<ni...@neoxam.com.invalid> wrote:

> Hi Ignite,
>
> Question regarding CVE‑2024‑52577 affecting Ignite < 2.17 : we managed to
> smoothly upgrade to Ignite 2.17 in the latest version of our software to
> get rid of this vuln, but some of our clients are still using an older
> version of our software with Ignite 2.14. This version of our software is
> built and run with Java 8 and it’s not possible to upgrade Java on this
> version. Therefore, we cannot upgrade Ignite to 2.17. Any chance to get an
> Ignite version compatible with Java 8 that fixes CVE‑2024‑52577 ? Thanks
> for your input.
>
> Regards,
> Nicolas
>