Actions
Bug #23983
closed
Unimportant CVE on logback and icu4j
Pull Request:
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No
Description
- logback, same as https://issues.rudder.io/issues/23982
- icu4j-23.1.1.jar: CVE-2016-6293(9.8), CVE-2011-4599(7.5), CVE-2016-7415(9.8), CVE-2014-7926(7.5), CVE-2017-17484(9.8), CVE-2017-7867(7.5), CVE-2014-9911(9.8), CVE-2014-7923(7.5), CVE-2020-10531(8.8), CVE-2014-8147(7.5), CVE-2014-9654(9.8), CVE-2014-7940(7.5), CVE-2017-14952(9.8), CVE-2017-7868(7.5), CVE-2014-8146(7.5), CVE-2015-5922(10.0) => false positive because the scanner believes we're using icu4j 23.1.1 (that version doesn't even exists), while we are using graalvm 23.1.1 that shadows icu4j.
Updated by François ARMAND 4 months ago
- Status changed from New to In progress
- Assignee set to François ARMAND
Updated by François ARMAND 4 months ago
- Status changed from In progress to Pending technical review
- Assignee changed from François ARMAND to Alexis Mousset
- Pull Request set to https://github.com/Normation/rudder/pull/5306
Updated by Anonymous 4 months ago
- Status changed from Pending technical review to Pending release
Applied in changeset rudder|146f82f541a154db9c96ac4cb6cd44d605cca72d.
Updated by Vincent MEMBRÉ about 1 month ago
- Status changed from Pending release to Released
This bug has been fixed in Rudder 8.1.0~alpha1 which was released today.
Actions