epugh opened a new pull request, #224: URL: https://github.com/apache/solr-site/pull/224
Follow-up to #216. After digging back into the actual shaded dependency versions, the affected ranges on four of the Hadoop-client CVE statements were too broad. The four CVEs are attributed to libraries shaded inside `hadoop-client-runtime` (in the `hdfs` module). Reading the embedded `pom.properties` from each `hadoop-client-runtime-*.jar` across the Solr 9.x line shows those shaded libs were bumped to fixed versions when Solr moved to **Hadoop 3.4.1 in Solr 9.10.0** — one release earlier than the `9.10.1` bound the statements claimed: | CVE (shaded lib) | fix version | last vulnerable (Hadoop 3.4.0 = Solr 9.9.0) | fixed at | |---|---|---|---| | CVE-2023-52428 (nimbus-jose-jwt) | 9.37.2 | 9.31 | 9.10.0 (3.4.1 → 9.37.2) | | CVE-2024-25638 (dnsjava) | 3.6.0 | 3.4.0 | 9.10.0 (3.4.1 → 3.6.1) | | CVE-2024-26308 (commons-compress) | 1.26.0 | 1.24.0 | 9.10.0 (3.4.1 → 1.26.1) | | CVE-2024-29131/29133 (commons-configuration2) | 2.10.1 | 2.8.0 | 9.10.0 (3.4.1 → 2.10.1) | So the range on those four moves from `9.0.0-9.10.1` to **`9.0.0-9.9.0`**, with the body text updated to state the exact fix boundary. The **avro** entry (CVE-2024-47561 / CVE-2023-39410) keeps its `9.0.0-9.10.1` range — avro stayed at 1.9.2 through 9.10.1 and is only fixed in 9.11 (branch_9x, Hadoop 3.4.3 → avro 1.11.4). Its body is updated to make that boundary explicit. All statements remain `not_affected` / `code_not_reachable`; this only tightens the version metadata. Site builds and `vexctl merge` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
