Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] Fix CVE-2023-2976 #2940

Closed
stephen-crawford opened this issue Jul 5, 2023 · 1 comment
Closed

[BUG] Fix CVE-2023-2976 #2940

stephen-crawford opened this issue Jul 5, 2023 · 1 comment
Assignees
@stephen-crawford
Labels
bug Something isn't working untriaged Require the attention of the repository maintainers and may need to be prioritized

Comments

@stephen-crawford
Copy link
Contributor

What is the bug?
We make use of Guava as part of the spotless and checkstyle build processes. It is not clear whether there is a concern if these style checking functions make use of a flagged library. We should address this just in case.
@stephen-crawford stephen-crawford added bug Something isn't working untriaged Require the attention of the repository maintainers and may need to be prioritized labels Jul 5, 2023
@stephen-crawford stephen-crawford self-assigned this Jul 5, 2023
@stephen-crawford
Copy link
Contributor Author

Addressed by #2937.

@jaguilar-atl jaguilar-atl mentioned this issue Jul 27, 2023
Merged
3 tasks
cwperks pushed a commit that referenced this issue Jul 31, 2023
@jaguilar-atl @stephen-crawford
[1.3] Update guava to address CVE-2023-2976 (#3060)
eb9f698 
### Description
Update guava to address
[CVE-2023-2976](https://www.cve.org/CVERecord?id=CVE-2023-2976).

Seems like this has been resolved for 2.x so this PR is for the 1.3
branch.

### Issues Resolved
#2940

### Check List
- [ ] ~~New functionality includes testing~~
- [ ] ~~New functionality has been documented~~
- [x] Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and
signing off your commits, please check
[here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin).

---------

Signed-off-by: Josh Aguilar <[email protected]>
Signed-off-by: Stephen Crawford <[email protected]>
Co-authored-by: Stephen Crawford <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@stephen-crawford stephen-crawford

Labels
bug Something isn't working untriaged Require the attention of the repository maintainers and may need to be prioritized
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@DarshitChanpura @stephen-crawford