[
https://issues.apache.org/jira/browse/OAK-9491?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17422723#comment-17422723
]
Shraddha Jaiswal commented on OAK-9491:
---------------------------------------
Hello,
We are using oak1.26, and while running twistlock scan report this reported as
vulnerable for guava 15.0. We checked all available latest versions of Oak and
everywhere it is guava 15.0 only. Please suggest if you have plan to upgrade
guava as we are getting impacted due to security checks.
> Address vulnerabilities found by dependency checker plugin
> ----------------------------------------------------------
>
> Key: OAK-9491
> URL: https://issues.apache.org/jira/browse/OAK-9491
> Project: Jackrabbit Oak
> Issue Type: Task
> Affects Versions: 1.40.0, 1.22.7
> Reporter: Andrei Dulceanu
> Assignee: Andrei Dulceanu
> Priority: Major
> Labels: candidate_oak_1_22
>
> {noformat}
> One or more dependencies were identified with known vulnerabilities in
> Jackrabbit Oak:aggs-matrix-stats-client-7.1.1.jar
> (pkg:maven/org.elasticsearch.plugin/[email protected],
> cpe:2.3:a:elastic:elasticsearch:7.1.1:*:*:*:*:*:*:*,
> cpe:2.3:a:elasticsearch:elasticsearch:7.1.1:*:*:*:*:*:*:*) : CVE-2019-7614,
> CVE-2019-7619, CVE-2020-7009, CVE-2020-7014, CVE-2020-7019, CVE-2020-7020,
> CVE-2020-7021
> bcprov-jdk15on-1.65.jar (pkg:maven/org.bouncycastle/[email protected],
> cpe:2.3:a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.65:*:*:*:*:*:*:*)
> : CVE-2020-28052
> commons-io-2.6.jar (pkg:maven/commons-io/[email protected],
> cpe:2.3:a:apache:commons_io:2.6:*:*:*:*:*:*:*) : CVE-2021-29425
> cxf-core-3.3.6.jar (pkg:maven/org.apache.cxf/[email protected],
> cpe:2.3:a:apache:cxf:3.3.6:*:*:*:*:*:*:*) : CVE-2020-13954, CVE-2021-22696,
> CVE-2021-30468
> elasticsearch-core-7.1.1.jar
> (pkg:maven/org.elasticsearch/[email protected],
> cpe:2.3:a:elastic:elasticsearch:7.1.1:*:*:*:*:*:*:*,
> cpe:2.3:a:elasticsearch:elasticsearch:7.1.1:*:*:*:*:*:*:*) : CVE-2019-7614,
> CVE-2019-7619, CVE-2020-7009, CVE-2020-7014, CVE-2020-7019, CVE-2020-7020,
> CVE-2020-7021
> fluent-hc-4.5.12.jar (pkg:maven/org.apache.httpcomponents/[email protected],
> cpe:2.3:a:apache:httpclient:4.5.12:*:*:*:*:*:*:*) : CVE-2020-13956
> groovy-2.5.2.jar (pkg:maven/org.codehaus.groovy/[email protected],
> cpe:2.3:a:apache:groovy:2.5.2:*:*:*:*:*:*:*) : CVE-2020-17521
> groovy-all-2.4.17.jar (pkg:maven/org.codehaus.groovy/[email protected],
> cpe:2.3:a:apache:groovy:2.4.17:*:*:*:*:*:*:*) : CVE-2020-17521
> guava-15.0.jar (pkg:maven/com.google.guava/[email protected],
> cpe:2.3:a:google:guava:15.0:*:*:*:*:*:*:*) : CVE-2018-10237, CVE-2020-8908
> guava-18.0.jar (pkg:maven/com.google.guava/[email protected],
> cpe:2.3:a:google:guava:18.0:*:*:*:*:*:*:*) : CVE-2018-10237, CVE-2020-8908
> hibernate-validator-5.3.6.Final.jar
> (pkg:maven/org.hibernate/[email protected],
> cpe:2.3:a:hibernate:hibernate-validator:5.3.6:*:*:*:*:*:*:*,
> cpe:2.3:a:redhat:hibernate_validator:5.3.6:*:*:*:*:*:*:*) : CVE-2020-10693
> http2-client-9.4.27.v20200227.jar
> (pkg:maven/org.eclipse.jetty.http2/[email protected],
> cpe:2.3:a:eclipse:jetty:9.4.27:20200227:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:9.4.27:20200227:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:9.4.27:20200227:*:*:*:*:*:*) : CVE-2019-17638,
> CVE-2020-27216, CVE-2020-27218, CVE-2020-27223, CVE-2021-28165,
> CVE-2021-28169, CVE-2021-34428
> httpclient-4.5.12.jar (pkg:maven/org.apache.httpcomponents/[email protected],
> cpe:2.3:a:apache:httpclient:4.5.12:*:*:*:*:*:*:*) : CVE-2020-13956
> httpclient-osgi-4.5.12.jar/META-INF/maven/org.apache.httpcomponents/httpclient-cache/pom.xml
> (pkg:maven/org.apache.httpcomponents/[email protected],
> cpe:2.3:a:apache:httpclient:4.5.12:*:*:*:*:*:*:*) : CVE-2020-13956
> jackson-databind-2.10.3.jar
> (pkg:maven/com.fasterxml.jackson.core/[email protected],
> cpe:2.3:a:fasterxml:jackson-databind:2.10.3:*:*:*:*:*:*:*) : CVE-2020-25649
> java-xmlbuilder-1.1.jar (pkg:maven/com.jamesmurty.utils/[email protected])
> : CWE-611: Improper Restriction of XML External Entity Reference ('XXE')
> javax-websocket-server-impl-9.4.18.v20190429.jar
> (pkg:maven/org.eclipse.jetty.websocket/[email protected],
> cpe:2.3:a:eclipse:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:java-websocket_project:java-websocket:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:9.4.18:20190429:*:*:*:*:*:*) : CVE-2020-27216,
> CVE-2020-27218, CVE-2020-27223, CVE-2021-28165, CVE-2021-28169, CVE-2021-34428
> javax.servlet-3.0.0.v201112011016.jar
> (pkg:maven/org.eclipse.jetty.orbit/[email protected],
> cpe:2.3:a:eclipse:jetty:3.0.0:201112011016:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:3.0.0:201112011016:*:*:*:*:*:*) : CVE-2009-5045,
> CVE-2009-5046, CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2020-27216,
> CVE-2021-28169, CVE-2021-34428
> javax.websocket-api-1.0.jar
> (pkg:maven/javax.websocket/[email protected],
> cpe:2.3:a:java-websocket_project:java-websocket:1.0:*:*:*:*:*:*:*) :
> CVE-2020-11050
> jdom2-2.0.6.jar (pkg:maven/org.jdom/[email protected],
> cpe:2.3:a:jdom:jdom:2.0.6:*:*:*:*:*:*:*) : CVE-2021-33813
> jetty-http-9.4.27.v20200227.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:eclipse:jetty:9.4.27:20200227:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:9.4.27:20200227:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:9.4.27:20200227:*:*:*:*:*:*) : CVE-2019-17638,
> CVE-2020-27216, CVE-2020-27218, CVE-2020-27223, CVE-2021-28165,
> CVE-2021-28169, CVE-2021-34428
> jetty-io-8.2.0.v20160908.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:mortbay_jetty:jetty:8.2.0:20160908:*:*:*:*:*:*) : CVE-2021-28165
> jetty-io-9.4.18.v20190429.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:mortbay_jetty:jetty:9.4.18:20190429:*:*:*:*:*:*) : CVE-2021-28165
> jetty-io-9.4.27.v20200227.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:mortbay_jetty:jetty:9.4.27:20200227:*:*:*:*:*:*) : CVE-2021-28165
> jetty-server-8.2.0.v20160908.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:eclipse:jetty:8.2.0:20160908:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:8.2.0:20160908:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:8.2.0:20160908:*:*:*:*:*:*) : CVE-2017-7656,
> CVE-2017-7657, CVE-2017-7658, CVE-2017-9735, CVE-2019-10241, CVE-2019-10247,
> CVE-2020-27216, CVE-2021-28165, CVE-2021-28169, CVE-2021-34428
> jetty-server-9.4.18.v20190429.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:eclipse:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:9.4.18:20190429:*:*:*:*:*:*) : CVE-2020-27216,
> CVE-2020-27218, CVE-2020-27223, CVE-2021-28165, CVE-2021-28169, CVE-2021-34428
> jetty-util-8.2.0.v20160908.jar
> (pkg:maven/org.eclipse.jetty/[email protected],
> cpe:2.3:a:eclipse:jetty:8.2.0:20160908:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:8.2.0:20160908:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:8.2.0:20160908:*:*:*:*:*:*) : CVE-2017-7656,
> CVE-2017-7657, CVE-2017-7658, CVE-2019-10247, CVE-2020-27216, CVE-2021-28165,
> CVE-2021-28169, CVE-2021-34428
> junit-4.12.jar (pkg:maven/junit/[email protected]) : CVE-2020-15250
> lang-mustache-client-7.1.1.jar
> (pkg:maven/org.elasticsearch.plugin/[email protected],
> cpe:2.3:a:elastic:elasticsearch:7.1.1:*:*:*:*:*:*:*,
> cpe:2.3:a:elasticsearch:elasticsearch:7.1.1:*:*:*:*:*:*:*) : CVE-2019-7614,
> CVE-2019-7619, CVE-2020-7009, CVE-2020-7014, CVE-2020-7019, CVE-2020-7020,
> CVE-2020-7021
> log4j-1.2.16.jar (pkg:maven/log4j/[email protected],
> cpe:2.3:a:apache:log4j:1.2.16:*:*:*:*:*:*:*) : CVE-2019-17571, CVE-2020-9488
> log4j-1.2.17.jar (pkg:maven/log4j/[email protected],
> cpe:2.3:a:apache:log4j:1.2.17:*:*:*:*:*:*:*) : CVE-2019-17571, CVE-2020-9488
> log4j-api-2.11.1.jar (pkg:maven/org.apache.logging.log4j/[email protected],
> cpe:2.3:a:apache:log4j:2.11.1:*:*:*:*:*:*:*) : CVE-2020-9488
> log4j-over-slf4j-1.7.30.jar (pkg:maven/org.slf4j/[email protected],
> cpe:2.3:a:apache:log4j:1.7.30:*:*:*:*:*:*:*) : CVE-2020-9488
> mongo-java-driver-3.12.7.jar (pkg:maven/org.mongodb/[email protected],
> cpe:2.3:a:mongodb:java_driver:3.12.7:*:*:*:*:*:*:*) : CVE-2021-20328
> netty-3.7.0.Final.jar (pkg:maven/io.netty/[email protected],
> cpe:2.3:a:netty:netty:3.7.0:*:*:*:*:*:*:*) : CVE-2014-0193, CVE-2014-3488,
> CVE-2015-2156, CVE-2019-16869, CVE-2019-20444, CVE-2019-20445,
> CVE-2021-21290, CVE-2021-21295, CVE-2021-21409, POODLE vulnerability in
> SSLv3.0 support
> netty-transport-4.1.47.Final.jar
> (pkg:maven/io.netty/[email protected],
> cpe:2.3:a:netty:netty:4.1.47:*:*:*:*:*:*:*) : CVE-2021-21290, CVE-2021-21295,
> CVE-2021-21409
> netty-transport-4.1.52.Final.jar
> (pkg:maven/io.netty/[email protected],
> cpe:2.3:a:netty:netty:4.1.52:*:*:*:*:*:*:*) : CVE-2021-21290, CVE-2021-21295,
> CVE-2021-21409
> oak-jackrabbit-api-1.34.0.jar
> (pkg:maven/org.apache.jackrabbit/[email protected],
> cpe:2.3:a:apache:jackrabbit:1.34.0:*:*:*:*:*:*:*,
> cpe:2.3:a:apache:jackrabbit_oak:1.34.0:*:*:*:*:*:*:*) : CVE-2015-1833
> oak-segment-1.6.0.jar (pkg:maven/org.apache.jackrabbit/[email protected],
> cpe:2.3:a:apache:jackrabbit:1.6.0:*:*:*:*:*:*:*,
> cpe:2.3:a:apache:jackrabbit_oak:1.6.0:*:*:*:*:*:*:*) : CVE-2015-1833,
> CVE-2020-1940
> org.apache.felix.webconsole-4.2.10-all.jar: jquery-1.8.3.js
> (pkg:javascript/[email protected]) : CVE-2012-6708, CVE-2015-9251, CVE-2019-11358,
> CVE-2020-11022, CVE-2020-11023
> org.apache.felix.webconsole-4.2.10-all.jar: jquery-ui-1.9.2.js
> (pkg:javascript/[email protected],
> pkg:javascript/[email protected]) : CVE-2010-5312, CVE-2012-6662,
> CVE-2016-7103
> pom.xml (pkg:maven/org.apache.jackrabbit/[email protected],
> cpe:2.3:a:apache:jackrabbit:1.22.8:snapshot:*:*:*:*:*:*,
> cpe:2.3:a:apache:jackrabbit_oak:1.22.8:snapshot:*:*:*:*:*:*) : CVE-2015-1833
> pom.xml (pkg:maven/org.apache.jackrabbit/[email protected],
> cpe:2.3:a:apache:jackrabbit_oak:1.22.8:snapshot:*:*:*:*:*:*,
> cpe:2.3:a:apache:solr:1.22.8:snapshot:*:*:*:*:*:*) : CVE-2012-6612,
> CVE-2013-6397, CVE-2013-6407, CVE-2013-6408, CVE-2015-8795, CVE-2015-8796,
> CVE-2015-8797, CVE-2017-3163, CVE-2017-3164, CVE-2018-11802, CVE-2018-1308,
> CVE-2019-0193, CVE-2020-13941, CVE-2021-27905, CVE-2021-29262, CVE-2021-29943
> org.apache.servicemix.bundles.dom4j-2.1.1_1.jar
> (pkg:maven/org.apache.servicemix.bundles/[email protected]_1,
> cpe:2.3:a:dom4j_project:dom4j:2.1.1.1:*:*:*:*:*:*:*) : CVE-2020-10683
> org.apache.sling.commons.logservice-1.0.4.jar
> (pkg:maven/org.apache.sling/[email protected],
> cpe:2.3:a:apache:sling:1.0.4:*:*:*:*:*:*:*) : CVE-2016-5394, CVE-2016-6798
> parent-join-client-7.1.1.jar
> (pkg:maven/org.elasticsearch.plugin/[email protected],
> cpe:2.3:a:elastic:elasticsearch:7.1.1:*:*:*:*:*:*:*,
> cpe:2.3:a:elasticsearch:elasticsearch:7.1.1:*:*:*:*:*:*:*) : CVE-2019-7614,
> CVE-2019-7619, CVE-2020-7009, CVE-2020-7014, CVE-2020-7019, CVE-2020-7020,
> CVE-2020-7021
> pdfbox-2.0.19.jar (pkg:maven/org.apache.pdfbox/[email protected],
> cpe:2.3:a:apache:pdfbox:2.0.19:*:*:*:*:*:*:*) : CVE-2021-27807,
> CVE-2021-27906, CVE-2021-31811, CVE-2021-31812
> preflight-2.0.19.jar (pkg:maven/org.apache.pdfbox/[email protected],
> cpe:2.3:a:apache:pdfbox:2.0.19:*:*:*:*:*:*:*) : CVE-2021-27807,
> CVE-2021-27906, CVE-2021-31811, CVE-2021-31812
> rank-eval-client-7.1.1.jar
> (pkg:maven/org.elasticsearch.plugin/[email protected],
> cpe:2.3:a:elastic:elasticsearch:7.1.1:*:*:*:*:*:*:*,
> cpe:2.3:a:elasticsearch:elasticsearch:7.1.1:*:*:*:*:*:*:*) : CVE-2019-7614,
> CVE-2019-7619, CVE-2020-7009, CVE-2020-7014, CVE-2020-7019, CVE-2020-7020,
> CVE-2020-7021
> sentiment-analysis-parser-0.1.jar
> (pkg:maven/edu.usc.ir/[email protected],
> cpe:2.3:a:data_tools_project:data_tools:0.1:*:*:*:*:*:*:*) : CVE-2018-18749
> sis-netcdf-1.0.jar (pkg:maven/org.apache.sis.storage/[email protected],
> cpe:2.3:a:storage_project:storage:1.0:*:*:*:*:*:*:*) : CVE-2021-20291
> snakeyaml-1.17.jar (pkg:maven/org.yaml/[email protected],
> cpe:2.3:a:snakeyaml_project:snakeyaml:1.17:*:*:*:*:*:*:*) : CVE-2017-18640
> solr-solrj-8.6.3.jar (pkg:maven/org.apache.solr/[email protected],
> cpe:2.3:a:apache:solr:8.6.3:*:*:*:*:*:*:*) : CVE-2021-27905, CVE-2021-29262,
> CVE-2021-29943
> spring-core-4.3.24.RELEASE.jar
> (pkg:maven/org.springframework/[email protected],
> cpe:2.3:a:pivotal_software:spring_framework:4.3.24:release:*:*:*:*:*:*,
> cpe:2.3:a:springsource:spring_framework:4.3.24:release:*:*:*:*:*:*,
> cpe:2.3:a:vmware:spring_framework:4.3.24:release:*:*:*:*:*:*,
> cpe:2.3:a:vmware:springsource_spring_framework:4.3.24:release:*:*:*:*:*:*) :
> CVE-2020-5421
> tagsoup-1.2.1.jar (pkg:maven/org.ccil.cowan.tagsoup/[email protected],
> cpe:2.3:a:tag_project:tag:1.2.1:*:*:*:*:*:*:*) : CVE-2020-29242,
> CVE-2020-29243, CVE-2020-29244, CVE-2020-29245
> tika-core-1.24.1.jar (pkg:maven/org.apache.tika/[email protected],
> cpe:2.3:a:apache:tika:1.24.1:*:*:*:*:*:*:*) : CVE-2021-28657
> vorbis-java-tika-0.8.jar (pkg:maven/org.gagravarr/[email protected],
> cpe:2.3:a:flac_project:flac:0.8:*:*:*:*:*:*:*) : CVE-2017-6888
> websocket-common-9.4.18.v20190429.jar
> (pkg:maven/org.eclipse.jetty.websocket/[email protected],
> cpe:2.3:a:eclipse:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:java-websocket_project:java-websocket:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:websocket-extensions_project:websocket-extensions:9.4.18:20190429:*:*:*:*:*:*)
> : CVE-2020-27216, CVE-2020-27218, CVE-2020-27223, CVE-2021-28165,
> CVE-2021-28169, CVE-2021-34428
> websocket-server-9.4.18.v20190429.jar
> (pkg:maven/org.eclipse.jetty.websocket/[email protected],
> cpe:2.3:a:eclipse:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:java-websocket_project:java-websocket:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:jetty:jetty:9.4.18:20190429:*:*:*:*:*:*,
> cpe:2.3:a:mortbay_jetty:jetty:9.4.18:20190429:*:*:*:*:*:*) : CVE-2020-27216,
> CVE-2020-27218, CVE-2020-27223, CVE-2021-28165, CVE-2021-28169, CVE-2021-34428
> xmpbox-2.0.19.jar (pkg:maven/org.apache.pdfbox/[email protected],
> cpe:2.3:a:apache:pdfbox:2.0.19:*:*:*:*:*:*:*) : CVE-2021-27807,
> CVE-2021-27906, CVE-2021-31811, CVE-2021-31812
> zookeeper-3.4.6.jar (pkg:maven/org.apache.zookeeper/[email protected],
> cpe:2.3:a:apache:zookeeper:3.4.6:*:*:*:*:*:*:*) : CVE-2016-5017,
> CVE-2017-5637, CVE-2018-8012, CVE-2019-0201, CVE-2021-21409
> zookeeper-3.5.7.jar (pkg:maven/org.apache.zookeeper/[email protected],
> cpe:2.3:a:apache:zookeeper:3.5.7:*:*:*:*:*:*:*) : CVE-2021-21409
> -1,548 {noformat}
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
