kokosing commented on PR #1957:
URL: https://github.com/apache/phoenix/pull/1957#issuecomment-2326383208
@kgniew did a scan and returned with the following information:
With regards to the phoenix connector there are several CVEs related to
- `jackson-databind` package located here
phoenix5/phoenix-client-embedded-hbase-2.5.0-5.2.0.jar current package version
is 2.4.0 and it should be updated to 2.12.7.1
- `snappy-java` package located here phoenix5/phoenix-client-
embedded-hbase-2.5.0- 5.2.0.jar current package version is 1.0.5 and it
should be updated to 1.1.10.4
- `protobuf-java` package located here phoenix5/phoenix-client-
embedded-hbase-2.5.0- 5.2.0.jar current package version is 2.5.0 and it
should be updated to 3.16.3
- `avro` package located here phoenix5/phoenix-client-
embedded-hbase-2.5.0- 5.2.0.jar current package version is 1.7.7 and it
should be updated to 1.11.3
- `json-smart` package located here phoenix5/phoenix-client-
embedded-hbase-2.5.0- 5.2.0.jar current package version is 1.3.2 and it
should be updated to 2.4.9
- `jettision` package located here phoenix5/phoenix-client-
embedded-hbase-2.5.0- 5.2.0.jar current package version is 1.1 and it should
be updated to 1.5.4
- `netty` is also problematic however grype does not provide a fixed
version for critical CVE-2019-20444
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
