You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@rocketmq.apache.org by GitBox <gi...@apache.org> on 2020/02/28 00:51:01 UTC
[GitHub] [rocketmq] FdseLab opened a new issue #1803: Please avoid using
libraries with CVEs
FdseLab opened a new issue #1803: Please avoid using libraries with CVEs
URL: https://github.com/apache/rocketmq/issues/1803
Hi, I have noticed that some library CVEs may be related to your projects. I suggest a library update to avoid potential risks. The details are as follows.
* **Vulnerable Library Version:** com.google.guava : guava : 19.0
**CVE ID:** [CVE-2018-10237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237)
**Import Path:** filter/pom.xml
**Suggested Safe Versions:** 24.1.1-android, 24.1.1-jre, 25.0-android, 25.0-jre, 25.1-android, 25.1-jre, 26.0-android, 26.0-jre, 27.0-android, 27.0-jre, 27.0.1-android, 27.0.1-jre, 27.1-android, 27.1-jre, 28.0-android, 28.0-jre, 28.1-android, 28.1-jre, 28.2-android, 28.2-jre
* **Vulnerable Library Version:** org.apache.logging.log4j : log4j-core : 2.7
**CVE ID:** [CVE-2019-17571](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571), [CVE-2017-5645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5645)
**Import Path:** logappender/pom.xml, client/pom.xml
**Suggested Safe Versions:** 2.10.0, 2.11.0, 2.11.1, 2.11.2, 2.12.0, 2.12.1, 2.13.0, 2.8.2, 2.9.0, 2.9.1
* **Vulnerable Library Version:** ch.qos.logback : logback-classic : 1.0.13
**CVE ID:** [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
**Import Path:** logging/pom.xml, namesrv/pom.xml, tools/pom.xml, logappender/pom.xml, acl/pom.xml, store/pom.xml, example/pom.xml, broker/pom.xml
**Suggested Safe Versions:** 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0, 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
* **Vulnerable Library Version:** ch.qos.logback : logback-core : 1.0.13
**CVE ID:** [CVE-2017-5929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929)
**Import Path:** namesrv/pom.xml, tools/pom.xml, logappender/pom.xml, acl/pom.xml, store/pom.xml, broker/pom.xml
**Suggested Safe Versions:** 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0-alpha0, 1.3.0-alpha1, 1.3.0-alpha2, 1.3.0-alpha3, 1.3.0-alpha4, 1.3.0-alpha5
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [rocketmq] duhenglucky commented on issue #1803: Please avoid using
libraries with CVEs
Posted by GitBox <gi...@apache.org>.
duhenglucky commented on issue #1803: Please avoid using libraries with CVEs
URL: https://github.com/apache/rocketmq/issues/1803#issuecomment-592257114
@FdseLab We are grateful to you for pointing out these security holes, and we will check carefully and eliminate the hidden dangers. and it would be nice if you can submit a PR to make improvements together
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services