You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by "Brandon Williams (Jira)" <ji...@apache.org> on 2025/08/01 10:17:00 UTC
[jira] [Commented] (CASSANDRA-20810) Update logback jar version in branch cassandra-4.0
[ https://issues.apache.org/jira/browse/CASSANDRA-20810?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18011405#comment-18011405 ]
Brandon Williams commented on CASSANDRA-20810:
----------------------------------------------
{color:#000000}{color:#000000}{color:#000000}CASSANDRA-19142 {color}{color}{color}{color:#000000}{color:#000000}CASSANDRA-20408 {color}{color}{color:#000000}CASSANDRA-20412{color}
> Update logback jar version in branch cassandra-4.0
> --------------------------------------------------
>
> Key: CASSANDRA-20810
> URL: https://issues.apache.org/jira/browse/CASSANDRA-20810
> Project: Apache Cassandra
> Issue Type: Task
> Reporter: Jai Sharma
> Priority: Normal
>
> cassandra-4.0 is using logback-core and logback-classic version 1.2.9 which has following vulnerabilities.
> * CVE-2023-6378
> * CVE-2024-12798
> * CVE-2024-12801
> Upgrade logback-core and logback-classic to version 1.3.15 which has fixes for all 3.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org