[IO] Upgrade mariadb jdbc driver version to address vulnerabilities #14511
Conversation
Error: mariadb-java-client-2.6.0.jar: CVE-2020-28912, CVE-2021-46668, CVE-2021-46669, CVE-2021-46666, CVE-2021-46667, CVE-2021-46664, CVE-2021-46665, CVE-2021-46662, CVE-2021-46663, CVE-2021-46661
lhotari
added
area/connector
area/security
doc-not-needed
|
It looks like a false positive, jeremylong/DependencyCheck#2863 . It seems that the check added by #13972 has never passed? @dlg99 Can you confirm? |
|
@lhotari the check did pass before it was merged. The threat DB updates independently, sometimes several times a day and owasp plugin may misdetect something. If these are indeed false positives they can be suppressed https://github.com/apache/pulsar/blob/master/src/owasp-dependency-check-suppressions.xml |
|
I'll add that OWASP check had matched server vulnerabilities against client java libraries (e.g. clickhouse db server were matched to clickhouse-jdbc driver etc.) These happen due to too broadly matching patterns in the threat DB, if I understand correctly, and are safe to suppress. |
dlg99
left a comment
dlg99
left a comment
There was a problem hiding this comment.
Please suppress false positives for owasp check
|
Any updates? |
| <postgresql-jdbc.version>42.2.25</postgresql-jdbc.version> | ||
| <clickhouse-jdbc.version>0.3.2</clickhouse-jdbc.version> | ||
| <mariadb-jdbc.version>2.6.0</mariadb-jdbc.version> | ||
| <mariadb-jdbc.version>3.0.3</mariadb-jdbc.version> |
There was a problem hiding this comment.
MariaDB Connector/J 3.0.3 is NOT fully compatible with the latest release of version 2.7.
There was a problem hiding this comment.
@nodece please elaborate more about the incompatibility.
There was a problem hiding this comment.
The information from https://mariadb.com/kb/en/mariadb-connector-j-303-release-notes/.
NOTE: MariaDB Connector/J 3.0.3 is NOT fully compatible with the latest release of version 2.7.
|
closing this since #14593 resolves the OWASP dependency check false alarm. |
4 participants
Motivation
OWASP dependency check fails with this error:
Modifications