Skip to content

Conversation

@nicoloboschi
Copy link
Contributor

Motivation

Owasp check fails with

One or more dependencies were identified with known vulnerabilities in Pulsar :: Distribution :: Server:

netty-tcnative-boringssl-static-2.0.52.Final-osx-x86_64.jar (pkg:maven/io.netty/netty-tcnative-boringssl-static@2.0.52.Final, cpe:2.3:a:chromium_project:chromium:2.0.52:*:*:*:*:*:*:*) : CVE-2011-1797

It's clearly a false positive jeremylong/DependencyCheck#4776

Modifications

  • Suppress the violation
  • doc-not-needed

Copy link
Member

@tisonkun tisonkun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

It seems this FP has been resolved on upstream jeremylong/DependencyCheck#4154 but it suffers a regression.

@github-actions github-actions bot added the doc-not-needed Your PR changes do not impact docs label Aug 25, 2022
@tisonkun
Copy link
Member

cc @codelipenghui @eolivelli we can merge this patch and unblock other patches touching dependencies.

Copy link
Contributor

@eolivelli eolivelli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

@eolivelli eolivelli merged commit 409bb12 into apache:master Aug 29, 2022
@Technoboy- Technoboy- added this to the 2.11.0 milestone Aug 29, 2022
nicoloboschi added a commit to datastax/pulsar that referenced this pull request Aug 30, 2022
Jason918 pushed a commit that referenced this pull request Sep 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants