[
https://issues.apache.org/jira/browse/KNOX-3401?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100285#comment-18100285
]
Sandor Molnar commented on KNOX-3401:
-------------------------------------
The currently used version is flagged with 1 direct vulnerability:
!image-2026-07-30-07-34-16-369.png|height=300!
!screenshot-1.png|height=300!
Fortunately, [CVE-2022-46337|https://www.cve.org/CVERecord?id=CVE-2022-46337]
does not affect us as we use Derby's embedded datasource in a way such that
it's protected by a username/password pair (which we store in Knox's
gateway-level credential store).
> Switch OOTB JDBC-based token state service from Derby to something else
> -----------------------------------------------------------------------
>
> Key: KNOX-3401
> URL: https://issues.apache.org/jira/browse/KNOX-3401
> Project: Apache Knox
> Issue Type: Bug
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Priority: Major
> Attachments: image-2026-07-30-07-34-16-369.png, screenshot-1.png
>
>
> The community agreed to switch from alias-based TSS to JDBC-based TSS as the
> default implementation due to several reasons, details are found in [this
> e-mail
> thread|https://lists.apache.org/thread/fs9nkl6l45o330ttvgvqxj3jnxt63bcs].
> At that time (late 2023), Derby DB seemed a good choice given its wide range
> of configs and community support. However, the project os now retired, this
> is what's listed on their Apache page:
> h2. Derby Retired
> *On 2025-10-10, the Derby developers voted to retire the project into a
> read-only state. Derby development and bug-fixing have ended. No further
> releases will be published. The Derby website and wiki are frozen in place.
> Derby JIRA issues are now read-only and new bugs cannot be logged. The user
> and developer lists are disabled and can be accessed only through their
> archives.*
>
> Therefore, we need to find another DB vendor that satisfies our needs and can
> be used as Knox's default token state backend.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
