You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@avro.apache.org by "Andrew May (Jira)" <ji...@apache.org> on 2021/11/16 18:11:00 UTC

[jira] [Commented] (AVRO-3111) Update Hadoop versions to prevent false-positive security reports

    [ https://issues.apache.org/jira/browse/AVRO-3111?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17444701#comment-17444701 ] 

Andrew May commented on AVRO-3111:
----------------------------------

Thanks for the response Ryan, I've sent an email to cpe_dictionary@nist.gov  to report this to them & have linked to your response

> Update Hadoop versions to prevent false-positive security reports
> -----------------------------------------------------------------
>
>                 Key: AVRO-3111
>                 URL: https://issues.apache.org/jira/browse/AVRO-3111
>             Project: Apache Avro
>          Issue Type: Bug
>          Components: java
>    Affects Versions: 1.10.1, 1.10.2
>         Environment: Docker image built on library/buildpack-deps:buster-curl ([buildpack-deps (docker.com)|https://hub.docker.com/_/buildpack-deps])
>            Reporter: David L. Day
>            Assignee: Ismaël Mejía
>            Priority: Major
>             Fix For: 1.11.0
>
>
> When installing avro-tools in a container on a debian image, my company's image scanner reports CVE-2019-17195:
> _Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass._
> I see other Apache projects have had this CVE reported and have been fixed, but did not see where this was reported for Apache Avro Tools specifically.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)