Devaspati Krishnatri created CALCITE-6181:
---------------------------------------------
Summary: Upgrade janino to 3.1.10
Key: CALCITE-6181
URL: https://issues.apache.org/jira/browse/CALCITE-6181
Project: Calcite
Issue Type: Task
Reporter: Devaspati Krishnatri
Upgrade Janino to 3.1.10 due to CVE-2023-33546
janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when
using the expression evaluator.guess parameter name method. If the parser runs
on user-supplied input, an attacker could supply content that causes the parser
to crash due to a stack overflow.
CVSSv3 Score:- 5.5(Medium)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
