[
https://issues.apache.org/jira/browse/CASSANDRA-17364?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17489567#comment-17489567
]
PJ Fanning commented on CASSANDRA-17364:
----------------------------------------
[https://github.com/apache/cassandra/blob/trunk/build.xml#L510] shows a
dependency on v2.6
[https://mvnrepository.com/artifact/commons-io/commons-io/2.6] shows the CVE -
[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425]
In
[https://mvnrepository.com/artifact/org.apache.cassandra/cassandra-all/4.0.1] -
commons-io is a 'managed' dependency - maybe OWASP report ignores these
dependencies.
commons-io 2.x tends to be good with backward compatibility - so if code works
with v2.6, it will almost certainly work with v2.11.0 (latest version).
Would it be possible to upgrade based on this info?
> dependency on commons-io is to 2.6 which has a CVE
> --------------------------------------------------
>
> Key: CASSANDRA-17364
> URL: https://issues.apache.org/jira/browse/CASSANDRA-17364
> Project: Cassandra
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Normal
>
> Can this be upgraded, ideally to v2.11.0?
> [https://mvnrepository.com/artifact/org.apache.cassandra/cassandra-all/4.0.1]
> [https://github.com/apache/cassandra/blob/trunk/build.xml#L510]
>
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
