sonatype-lift[bot] commented on a change in pull request #349:
URL: https://github.com/apache/solr/pull/349#discussion_r734108078
##########
File path: solr/contrib/prometheus-exporter/build.gradle
##########
@@ -22,6 +22,8 @@ description = 'Prometheus exporter for exposing metrics from
Solr using Metrics
dependencies {
implementation project(':solr:solrj')
+ implementation 'org.slf4j:slf4j-api'
+ implementation('org.apache.zookeeper:zookeeper') { transitive = false } //
ideally remove ZK dep
Review comment:
*Severe OSS Vulnerability:*
### pkg:maven/org.apache.zookeeper/zookeeper@3.7.0
0 Critical, 2 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found
across 1 dependencies
<details>
<summary><b>Components</b></summary><br/>
<ul>
<details>
<summary><b>pkg:maven/org.apache.zookeeper/zookeeper@3.7.0</b></summary>
<ul>
<details>
<summary><b>SEVERE Vulnerabilities (2)</b></summary><br/>
<ul>
<details>
<summary>CVE-2021-28164</summary>
> #### [CVE-2021-28164] In Eclipse Jetty 9.4.37.v20210219 to
9.4.38.v20210224, the default compliance mo...
> In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default
compliance mode allows requests with URIs that contain %2e or %2e%2e segments
to access protected resources within the WEB-INF directory. For example a
request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can
reveal sensitive information regarding the implementation of a web application.
>
> **CVSS Score:** 5.3
>
> **CVSS Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
</details>
<details>
<summary>CVE-2021-34429</summary>
> #### [CVE-2021-34429] For Eclipse Jetty versions 9.4.37-9.4.42,
10.0.1-10.0.5 & 11.0.1-11.0.5, URIs ca...
> For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 &
11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the
content of the WEB-INF directory and/or bypass some security constraints. This
is a variation of the vulnerability reported in
CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
>
> **CVSS Score:** 5.3
>
> **CVSS Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
</details>
</ul>
</details>
</ul>
</details>
</ul>
</details>
(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with
`help` or `ignore`)
##########
File path: solr/test-framework/build.gradle
##########
@@ -26,10 +26,17 @@ dependencies {
api "org.apache.lucene:lucene-test-framework"
api "org.apache.lucene:lucene-analysis-common"
- api 'org.apache.logging.log4j:log4j-core'
- api 'io.opentracing:opentracing-mock'
+ implementation('org.apache.zookeeper:zookeeper', {
Review comment:
*Severe OSS Vulnerability:*
### pkg:maven/org.apache.zookeeper/zookeeper@3.7.0
0 Critical, 2 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found
across 1 dependencies
<details>
<summary><b>Components</b></summary><br/>
<ul>
<details>
<summary><b>pkg:maven/org.apache.zookeeper/zookeeper@3.7.0</b></summary>
<ul>
<details>
<summary><b>SEVERE Vulnerabilities (2)</b></summary><br/>
<ul>
<details>
<summary>CVE-2021-28164</summary>
> #### [CVE-2021-28164] In Eclipse Jetty 9.4.37.v20210219 to
9.4.38.v20210224, the default compliance mo...
> In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default
compliance mode allows requests with URIs that contain %2e or %2e%2e segments
to access protected resources within the WEB-INF directory. For example a
request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can
reveal sensitive information regarding the implementation of a web application.
>
> **CVSS Score:** 5.3
>
> **CVSS Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
</details>
<details>
<summary>CVE-2021-34429</summary>
> #### [CVE-2021-34429] For Eclipse Jetty versions 9.4.37-9.4.42,
10.0.1-10.0.5 & 11.0.1-11.0.5, URIs ca...
> For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 &
11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the
content of the WEB-INF directory and/or bypass some security constraints. This
is a variation of the vulnerability reported in
CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
>
> **CVSS Score:** 5.3
>
> **CVSS Vector:** CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
</details>
</ul>
</details>
</ul>
</details>
</ul>
</details>
(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with
`help` or `ignore`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
