You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@avro.apache.org by "Martin Tzvetanov Grigorov (Jira)" <ji...@apache.org> on 2022/10/28 07:21:00 UTC
[jira] [Resolved] (AVRO-3656) Vulnerabilities from dependencies - jackson-databind & commons-text
[ https://issues.apache.org/jira/browse/AVRO-3656?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Martin Tzvetanov Grigorov resolved AVRO-3656.
---------------------------------------------
Fix Version/s: 1.12.0
1.11.2
Assignee: Martin Tzvetanov Grigorov
Resolution: Fixed
> Vulnerabilities from dependencies - jackson-databind & commons-text
> -------------------------------------------------------------------
>
> Key: AVRO-3656
> URL: https://issues.apache.org/jira/browse/AVRO-3656
> Project: Apache Avro
> Issue Type: Bug
> Affects Versions: 1.11.1
> Reporter: Ragul
> Assignee: Martin Tzvetanov Grigorov
> Priority: Critical
> Fix For: 1.12.0, 1.11.2
>
>
> Version 1.11.1 of avro-compiler contains the apache commons-text vulnerable library (1.9) &
> Jackson-databind (2.12.7)
>
> Vulnerabilities from dependencies:
> [CVE-2022-42889|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889]
> [CVE-2022-42004|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42004]
> [CVE-2022-42003|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42003]
>
> Is there any plan to upgrade dependency and address this issue?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)