[jira] [Updated] (CASSANDRA-17459) OWASP failures on trunk

["Brandon Williams (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CASSANDRA-17459?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Brandon Williams updated CASSANDRA-17459:
-----------------------------------------
     Bug Category: Parent values: Security(12985)
       Complexity: Normal
      Component/s: Build
    Discovered By: User Report
    Fix Version/s: 4.x
         Severity: Normal
         Assignee: Brandon Williams
           Status: Open  (was: Triage Needed)

> OWASP failures on trunk
> -----------------------
>
>                 Key: CASSANDRA-17459
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-17459
>             Project: Cassandra
>          Issue Type: Bug
>          Components: Build
>            Reporter: Brandon Williams
>            Assignee: Brandon Williams
>            Priority: Normal
>             Fix For: 4.x
>
>
> On trunk there are a few failures:
> {quote}
> Dependency-Check Failure:
> One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '1.0': 
> cassandra-driver-core-3.11.0-shaded.jar: CVE-2021-44521
> jackson-databind-2.12.5.jar: CVE-2020-36518
> netty-tcnative-classes-2.0.46.Final.jar: CVE-2021-43797, CVE-2019-16869, CVE-2015-2156, CVE-2021-37136, CVE-2014-3488, CVE-2021-37137, CVE-2019-20445, CVE-2019-20444, CVE-2021-21295, CVE-2021-21409, CVE-2021-21290
> See the dependency-check report for more details.
> {quote}
> Notably, we have bitten ourselves with CVE-2021-44521, which the driver has echoed, which we depend on.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org