You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@calcite.apache.org by "Sean Broeder (Jira)" <ji...@apache.org> on 2022/12/13 22:44:00 UTC

[jira] [Commented] (CALCITE-5379) Upgrade protobuf version to 3.21.9 because of CVE

    [ https://issues.apache.org/jira/browse/CALCITE-5379?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17646856#comment-17646856 ] 

Sean Broeder commented on CALCITE-5379:
---------------------------------------

My apologies if this would be better suited on the discussion list, but I was trying to heed Julian's concerns regarding the CVE and minimize publicity.   I'm not sure if this will only get released in avatica-1.23.0 or potentially in avatica-1.22.1?  If only in avatica-1.23.0 would that only be released just prior to the next Calcite release?

> Upgrade protobuf version to 3.21.9 because of CVE
> -------------------------------------------------
>
>                 Key: CALCITE-5379
>                 URL: https://issues.apache.org/jira/browse/CALCITE-5379
>             Project: Calcite
>          Issue Type: Improvement
>          Components: avatica
>    Affects Versions: avatica-1.22.0
>            Reporter: Sergey Nuyanzin
>            Assignee: Sergey Nuyanzin
>            Priority: Major
>             Fix For: avatica-1.23.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> There is a CVE in current version https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171
> fixed in 3.21.7



--
This message was sent by Atlassian Jira
(v8.20.10#820010)