You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@bookkeeper.apache.org by GitBox <gi...@apache.org> on 2020/02/28 14:36:32 UTC
[GitHub] [bookkeeper] cyxu2 opened a new issue #2275: There are several CVEs
in the project dependencies
cyxu2 opened a new issue #2275: There are several CVEs in the project dependencies
URL: https://github.com/apache/bookkeeper/issues/2275
I found your project used some dependencies that contain CVEs. I suggest a library update to avoid potential risks. See below for more details:
* **Vulnerable Library Version:** org.apache.hadoop : hadoop-common : 2.7.3
**CVE ID:** [CVE-2016-6811](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6811), [CVE-2017-15718](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15718), [CVE-2018-8029](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8029), [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713), [CVE-2018-8009](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8009)
**Import Path:** stream/distributedlog/io/dlfs/pom.xml
**Suggested Safe Versions:** 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.2.1
* **Vulnerable Library Version:** com.google.guava : guava : 21.0
**CVE ID:** [CVE-2018-10237](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237)
**Import Path:** bookkeeper-common/pom.xml, bookkeeper-stats-providers/prometheus-metrics-provider/pom.xml, bookkeeper-stats-providers/codahale-metrics-provider/pom.xml, stream/distributedlog/common/pom.xml, stream/statelib/pom.xml, circe-checksum/pom.xml, bookkeeper-http/vertx-http-server/pom.xml, cpu-affinity/pom.xml
**Suggested Safe Versions:** 24.1.1-android, 24.1.1-jre, 25.0-android, 25.0-jre, 25.1-android, 25.1-jre, 26.0-android, 26.0-jre, 27.0-android, 27.0-jre, 27.0.1-android, 27.0.1-jre, 27.1-android, 27.1-jre, 28.0-android, 28.0-jre, 28.1-android, 28.1-jre, 28.2-android, 28.2-jre
* **Vulnerable Library Version:** io.vertx : vertx-web : 3.4.1
**CVE ID:** [CVE-2018-12540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12540)
**Import Path:** bookkeeper-http/vertx-http-server/pom.xml
**Suggested Safe Versions:** 3.5.3, 3.5.3.CR1, 3.5.4, 3.6.0, 3.6.0.CR1, 3.6.0.CR2, 3.6.1, 3.6.2, 3.6.3, 3.7.0, 3.7.1, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.3-01, 3.8.4, 3.8.5, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4
* **Vulnerable Library Version:** org.apache.commons : commons-compress : 1.15
**CVE ID:** [CVE-2018-1324](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1324), [CVE-2019-12402](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12402), [CVE-2018-11771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11771)
**Import Path:** tests/integration-tests-utils/pom.xml
**Suggested Safe Versions:** 1.19, 1.20
* **Vulnerable Library Version:** org.apache.thrift : libthrift : 0.9.3
**CVE ID:** [CVE-2018-1320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1320)
**Import Path:** stream/distributedlog/core/pom.xml
**Suggested Safe Versions:** 0.12.0, 0.13.0
* **Vulnerable Library Version:** com.fasterxml.jackson.core : jackson-databind : 2.9.7
**CVE ID:** [CVE-2020-8840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8840), [CVE-2019-16335](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16335), [CVE-2019-20330](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20330), [CVE-2019-12384](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12384), [CVE-2019-14439](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14439), [CVE-2018-19362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19362), [CVE-2018-19361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19361), [CVE-2019-17531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531), [CVE-2019-12086](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086), [CVE-2019-12814](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12814), [CVE-2019-16943](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16943), [CVE-2019-14379](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14379), [CVE-2019-14540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540), [CVE-2018-19360](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19360), [CVE-2019-17267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17267), [CVE-2019-16942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942)
**Import Path:** bookkeeper-common/pom.xml, bookkeeper-http/http-server/pom.xml
**Suggested Safe Versions:** 2.10.0, 2.10.1, 2.10.2, 2.9.10.3
* **Vulnerable Library Version:** io.vertx : vertx-core : 3.4.1
**CVE ID:** [CVE-2018-12537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12537), [CVE-2018-12541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12541)
**Import Path:** bookkeeper-http/vertx-http-server/pom.xml
**Suggested Safe Versions:** 3.5.4, 3.6.0, 3.6.0.CR1, 3.6.0.CR2, 3.6.1, 3.6.2, 3.6.3, 3.7.0, 3.7.1, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4
* **Vulnerable Library Version:** org.apache.zookeeper : zookeeper : 3.4.13
**CVE ID:** [CVE-2019-0201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0201)
**Import Path:** bookkeeper-benchmark/pom.xml, bookkeeper-server/pom.xml, bookkeeper-server/pom.xml, stream/distributedlog/core/pom.xml, stream/bk-grpc-name-resolver/pom.xml, tests/integration-tests-utils/pom.xml
**Suggested Safe Versions:** 3.4.14, 3.5.5, 3.5.6, 3.5.7
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
[GitHub] [bookkeeper] eolivelli commented on issue #2275: There are several
CVEs in the project dependencies
Posted by GitBox <gi...@apache.org>.
eolivelli commented on issue #2275: There are several CVEs in the project dependencies
URL: https://github.com/apache/bookkeeper/issues/2275#issuecomment-592686817
Do you mind sending pull requests for upgrades?
One library at a time please.
It will be very appreciated.
We have a pending work for Zookeeper, that is harder.
Other deps would be easier
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services