[
https://issues.apache.org/jira/browse/IGNITE-9900?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16653295#comment-16653295
]
Ignite TC Bot commented on IGNITE-9900:
---------------------------------------
{panel:title=Possible
Blockers|borderStyle=dashed|borderColor=#ccc|titleBGColor=#F7D6C1}
{color:#d04437}Hadoop{color} [[tests 0 Exit Code
|https://ci.ignite.apache.org/viewLog.html?buildId=2104364]]
*
IgniteHadoopFileSystemClientBasedDualAsyncSelfTest.testClientReconnectMultithreaded
(last started)
{panel}
[TeamCity Run
All|http://ci.ignite.apache.org/viewLog.html?buildId=2100506&buildTypeId=IgniteTests24Java8_RunAll]
> Upgrade annotations.jar to a new version
> ----------------------------------------
>
> Key: IGNITE-9900
> URL: https://issues.apache.org/jira/browse/IGNITE-9900
> Project: Ignite
> Issue Type: Improvement
> Reporter: Stanislav Lukyanov
> Assignee: Stanislav Lukyanov
> Priority: Major
>
> OWASP Dependency Check reports that annotations.jar of version 13.0 is
> affected by vulnerability CVE-2017-8316,
> while it obviously isn't (the CVE is about XXE attack, and annotations.jar
> is, well, annotations).
> The issue is that NVD database only says that "intellij_idea" is affected,
> and OWASP doesn't know better than to map annotations.jar to the
> intellij_idea product.
> While the problem could be (and perhaps will be, see
> https://youtrack.jetbrains.com/issue/IDEA-200601) sorted out on the level of
> OWASP and NVD, the easiest way to workaround this is to upgrade
> annotations.jar to a new version (currently 16.0.3). It will help Ignite
> users to avoid annoying false-positive warnings from OWASP.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
