[
https://issues.apache.org/jira/browse/NIFI-10748?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17627731#comment-17627731
]
David Handermann commented on NIFI-10748:
-----------------------------------------
As noted in the comments for NIFI-9585, the reference to H2 1.4.200 is
necessary in order to support automatic migration from older versions. Removes
some of the vulnerable classes and repackages the H2 library for the sole
purpose of migration, so no H2 1.4 code is used after the migration process
completes.
We should be able to drop the migration support in the next major release of
NiFi, but it is still necessary for now.
> Upgrade com.h2database to 2.1.214
> ---------------------------------
>
> Key: NIFI-10748
> URL: https://issues.apache.org/jira/browse/NIFI-10748
> Project: Apache NiFi
> Issue Type: Improvement
> Affects Versions: 1.18.0
> Reporter: Mike R
> Priority: Major
>
> There are several versions of com.h2database used in NiFi, with some
> instances being 2.1.214, while others are 1.4.200.
> There are several CVE in the 1.4.200 program that are resolved in 2.1.214
> that are all high or critical with scores above 8.1:
> [CVE-2022-23221|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23221]
> [CVE-2021-42392|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42392]
> [CVE-2021-23463|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23463]
> The last remaining instance is found at: nifi-h2/nifi-h2-database/pom.xml
> It looks like the remaining instances of h2 were updated in
> [NiFi-9585|[NIFI-9585 Upgraded H2 from 1.4 to 2.1.210 · apache/nifi@bcc8d03
> (github.com)|https://github.com/apache/nifi/commit/bcc8d03314889e7d2d0724390059d0315efe2a34]]
>
> Here are the release notes for h2 database
> http://www.h2database.com/html/changelog.html
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
