Mike R created NIFI-10748: ----------------------------- Summary: Upgrade com.h2database to 2.1.214 Key: NIFI-10748 URL: https://issues.apache.org/jira/browse/NIFI-10748 Project: Apache NiFi Issue Type: Improvement Affects Versions: 1.18.0 Reporter: Mike R
There are several versions of com.h2database used in NiFi, with some instances being 2.1.214, while others are 1.4.200. There are several CVE in the 1.4.200 program that are resolved in 2.1.214 that are all high or critical with scores above 8.1: [CVE-2022-23221|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23221] [CVE-2021-42392|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42392] [CVE-2021-23463|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23463] The last remaining instance is found at: nifi-h2/nifi-h2-database/pom.xml It looks like the remaining instances of h2 were updated in [NiFi-9585|[NIFI-9585 Upgraded H2 from 1.4 to 2.1.210 ยท apache/nifi@bcc8d03 (github.com)|https://github.com/apache/nifi/commit/bcc8d03314889e7d2d0724390059d0315efe2a34]] -- This message was sent by Atlassian Jira (v8.20.10#820010)