Skip to content

[Snyk] Fix for 21 vulnerabilities #250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
chncaption wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 21 vulnerabilities #250

chncaption wants to merge 1 commit into from

Conversation

@chncaption
Copy link
Owner

@chncaption chncaption commented Dec 4, 2025

snyk-top-banner

Snyk has created this PR to fix 21 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

  • fe/fe-core/pom.xml
  • fe/pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue Score Upgrade
medium severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426		   670   org.apache.spark:spark-core_2.12:
2.4.6 -> 3.5.0
Major version upgrade Reachable Proof of Concept
high severity Out-of-bounds Read
SNYK-JAVA-NETJPOUNTZLZ4-14151790		   640   org.apache.kafka:kafka-clients:
0.10.1.1 -> 1.0.0
Major version upgrade No Path Found No Known Exploit
high severity Uncontrolled Recursion
SNYK-JAVA-COMMONSLANG-10734077		   590   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
high severity Stack-based Buffer Overflow
SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754		   585   org.apache.spark:spark-core_2.12:
2.4.6 -> 3.5.0
Major version upgrade No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538		   585   org.apache.spark:spark-core_2.12:
2.4.6 -> 3.5.0
Major version upgrade No Path Found No Known Exploit
high severity Stack-based Buffer Overflow
SNYK-JAVA-COMGOOGLEPROTOBUF-8055227		   585   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
high severity Incorrect Authorization
SNYK-JAVA-ORGSPRINGFRAMEWORK-12817817		   585   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
high severity Authorization Bypass Through User-Controlled Key
SNYK-JAVA-ORGAPACHEZOOKEEPER-5961102		   555   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
medium severity Directory Traversal
SNYK-JAVA-COMMONSIO-1277109		   535   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found Mature
high severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244		   525   org.apache.spark:spark-core_2.12:
2.4.6 -> 3.5.0
Major version upgrade No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-COMGOOGLEPROTOBUF-2331703		   525   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-COMGOOGLEPROTOBUF-3167772		   525   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424		   520   org.apache.spark:spark-core_2.12:
2.4.6 -> 3.5.0
Major version upgrade No Path Found Proof of Concept
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JAVA-COMMONSIO-8161190		   495   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
low severity Information Exposure
SNYK-JAVA-COMMONSCODEC-561518		   485   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade Reachable No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698		   445   org.apache.spark:spark-core_2.12:
2.4.6 -> 3.5.0
Major version upgrade No Path Found No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-COMGOOGLEPROTOBUF-3040284		   435   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
low severity Information Disclosure
SNYK-JAVA-COMGOOGLEGUAVA-1015415		   390   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found Proof of Concept
low severity Creation of Temporary File in Directory with Insecure Permissions
SNYK-JAVA-COMGOOGLEGUAVA-5710356		   315   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
low severity Improper Handling of Case Sensitivity
SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364		   265   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit
low severity Improper Handling of Case Sensitivity
SNYK-JAVA-ORGSPRINGFRAMEWORK-8230365		   265   com.alibaba.otter:canal.protocol:
1.1.6 -> 3.0.0
Major version upgrade No Path Found No Known Exploit

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Creation of Temporary File in Directory with Insecure Permissions
🦉 Directory Traversal
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: fe/fe-core/pom.xml & fe/pom.xml to reduce vulnerabilities
9e408c6 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426
- https://snyk.io/vuln/SNYK-JAVA-NETJPOUNTZLZ4-14151790
- https://snyk.io/vuln/SNYK-JAVA-COMMONSLANG-10734077
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-8055227
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-12817817
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEZOOKEEPER-5961102
- https://snyk.io/vuln/SNYK-JAVA-COMMONSIO-1277109
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-2331703
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-3167772
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424
- https://snyk.io/vuln/SNYK-JAVA-COMMONSIO-8161190
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2326698
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-3040284
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-1015415
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEGUAVA-5710356
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364
- https://snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-8230365
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@chncaption @snyk-bot