[ https://issues.apache.org/jira/browse/AVRO-2217?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16684111#comment-16684111 ]
ASF GitHub Bot commented on AVRO-2217: -------------------------------------- Fokko commented on issue #373: AVRO-2217 Bump Guava to patch security issues URL: https://github.com/apache/avro/pull/373#issuecomment-437959848 Oops, that's a typo, thanks @nandorKollar. I've did a small bump since Guava is always dangerous to update. To keep compatibility, I've looked at several projects, and a couple of them use `14.0.1` :-) ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org > Vulnerabilities in avro bundled packages > ---------------------------------------- > > Key: AVRO-2217 > URL: https://issues.apache.org/jira/browse/AVRO-2217 > Project: Apache Avro > Issue Type: Bug > Components: java > Affects Versions: 1.8.2 > Reporter: Prasanth Pallamreddy > Priority: Critical > > The following vulnerabilities exist in the packages bundled by Avro. These > packages need to be upgraded to the latest versions. Although a few of these > vulnerabilities were raised a couple of years ago in AVRO-1126 and an attempt > to address the backwards compatibility issue in AVRO-1605 there does not > appear to be a resolution. If there is no resolution on these issues, we may > be forced to fork based on [this PR|https://github.com/apache/avro/pull/87]. > > org.codehaus.jackson:jackson-mapper-asl:1.9.13 which is known to have these > critical / high vulns: > [https://nvd.nist.gov/vuln/detail/CVE-2018-7489] > [https://nvd.nist.gov/vuln/detail/CVE-2017-15095] > [https://nvd.nist.gov/vuln/detail/CVE-2017-7525] > [https://nvd.nist.gov/vuln/detail/CVE-2017-17485] > [https://nvd.nist.gov/vuln/detail/CVE-2018-5968] > org.codehaus.jackson:jackson-core-asl:1.9.13 which has this high > vulnerability: > - [https://nvd.nist.gov/vuln/detail/CVE-2016-7051] > org.apache.commons:commons-compress:1.8.1 has a DOS vulnerability: > - [https://nvd.nist.gov/vuln/detail/CVE-2018-11771] > com.google.guava:guava:11.0.2 > -[https://nvd.nist.gov/vuln/detail/CVE-2018-10237] > > > -- This message was sent by Atlassian JIRA (v7.6.3#76005)