forked from wolfi-dev/advisories
-
Notifications
You must be signed in to change notification settings - Fork 0
/
cassandra-reaper.advisories.yaml
225 lines (208 loc) · 14.5 KB
/
cassandra-reaper.advisories.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
schema-version: 2.0.2
package:
name: cassandra-reaper
advisories:
- id: CGA-23x4-gx5j-8vgc
aliases:
- CVE-2015-0886
- GHSA-9h6p-92jq-888x
events:
- timestamp: 2024-01-18T07:10:54Z
type: detection
data:
type: scan/v1
data:
subpackageName: cassandra-reaper
componentID: ba4f10860d804f63
componentName: jbcrypt
componentVersion: 0.3m
componentType: java-archive
componentLocation: /usr/local/lib/cassandra-reaper.jar
scanner: grype
- timestamp: 2024-01-18T10:02:13Z
type: pending-upstream-fix
data:
note: To be able to fix this CVE, we need to upgrade the "org.apache.cassandra:cassandra-all" dependency version from `2.2.12` which is the version project is currently using to at least `4.0.10` which is the version we should bump to to fix the CVEs but we can't because the build was failed due to compilation errors.
- id: CGA-q3vm-vqfx-h78g
aliases:
- CVE-2020-36518
- GHSA-57j2-w4cx-62h2
events:
- timestamp: 2024-01-19T09:07:56Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jackson-databind'' dependency to ''2.12.6.1'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-f5rx-9c8f-74fx
aliases:
- CVE-2020-8908
- GHSA-5mg8-w23w-74h3
events:
- timestamp: 2024-01-18T07:10:54Z
type: detection
data:
type: scan/v1
data:
subpackageName: cassandra-reaper
componentID: 8c597064497d4191
componentName: guava
componentVersion: 24.1.1-jre
componentType: java-archive
componentLocation: /usr/local/lib/cassandra-reaper.jar
scanner: grype
- timestamp: 2024-01-18T09:54:49Z
type: pending-upstream-fix
data:
note: Pending upstream fix, this fix will require some code changes since when we upgrade the "com.google.guava:guava" dependency version from 24.1.1 which is the version project is currently using to 32.0.0 which is the version we should bump to to fix the CVEs but we can't because the build was failed due to compilation errors.
- id: CGA-69ww-g5f5-g45f
aliases:
- CVE-2021-28168
- GHSA-c43q-5hpj-4crv
events:
- timestamp: 2024-01-19T09:08:17Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jersey-common'' dependency to ''2.34'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-wx62-j2gw-cp39
aliases:
- CVE-2021-46877
- GHSA-3x8x-79m2-3w2w
events:
- timestamp: 2024-01-19T09:07:48Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jackson-databind'' dependency to ''2.12.6'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-jwh4-jmxm-wfqg
aliases:
- CVE-2022-1471
- GHSA-mjmj-j48q-9wg2
events:
- timestamp: 2024-01-18T19:09:45Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''snakeyaml'' dependency to ''2.0'' or higher but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.yaml.snakeyaml.parser.ParserImpl.<init>(org.yaml.snakeyaml.reader.StreamReader)''. There is an also an open PR about the CVE in the ''snakeyaml'': https://github.com/thelastpickle/cassandra-reaper/pull/1455'
- id: CGA-8pv3-9h29-78pw
aliases:
- CVE-2022-42003
- GHSA-jjjh-jjxp-wpff
events:
- timestamp: 2024-01-19T09:08:02Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jackson-databind'' dependency to ''2.12.7.1'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-phgr-xjv2-gp8r
aliases:
- CVE-2022-42004
- GHSA-rgv9-q543-rqg4
events:
- timestamp: 2024-01-19T09:08:09Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jackson-databind'' dependency to ''2.12.7.1'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-9p4w-63v5-6h33
aliases:
- CVE-2023-26048
- GHSA-qw69-rqj8-6qw8
events:
- timestamp: 2024-01-19T09:08:39Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jetty-server'' dependency to ''9.4.51.v20230217'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-jpjc-49cf-82xf
aliases:
- CVE-2023-26049
- GHSA-p26g-97m4-6q7c
events:
- timestamp: 2024-01-19T09:08:32Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jetty-server'' dependency to ''9.4.51.v20230217'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-qjrq-jr26-67w4
aliases:
- CVE-2023-2976
- GHSA-7g45-4rm6-3mm3
events:
- timestamp: 2024-01-18T07:10:54Z
type: detection
data:
type: scan/v1
data:
subpackageName: cassandra-reaper
componentID: 8c597064497d4191
componentName: guava
componentVersion: 24.1.1-jre
componentType: java-archive
componentLocation: /usr/local/lib/cassandra-reaper.jar
scanner: grype
- timestamp: 2024-01-18T09:59:33Z
type: pending-upstream-fix
data:
note: Pending upstream fix, this fix will require some code changes since when we upgrade the "com.google.guava:guava" dependency version from 24.1.1 which is the version project is currently using to 32.0.0 which is the version we should upgrade to fix the CVEs but we can't because the build was failed due to compilation errors.
- id: CGA-88qf-p624-3qcw
aliases:
- CVE-2023-36479
- GHSA-3gh6-v5v9-6v9j
events:
- timestamp: 2024-01-19T09:08:48Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jetty-servlets'' dependency to ''9.4.52'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-5wg6-3472-f7g3
aliases:
- CVE-2023-40167
- GHSA-hmr7-m48g-48f6
events:
- timestamp: 2024-01-19T09:08:24Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''jetty-http'' dependency to ''9.4.52'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-h36w-hj2p-r73v
aliases:
- CVE-2023-46120
- GHSA-mm8h-8587-p46h
events:
- timestamp: 2024-01-19T09:06:27Z
type: pending-upstream-fix
data:
note: 'To fix the CVE we should bump the ''amqp-client'' dependency to ''5.18.0'' or higher, to do that, we should bump the ''dropwizard-core'' version to 2.1 or higher this is because ''amqp-client'' is one of the dependencies of the ''dropwizard-core'' but we cannot do that because the project does not work due to this error ''java.lang.NoSuchMethodError: void org.glassfish.jersey.server.ServerExecutorProvidersConfigurator.registerExecutors(org.glassfish.jersey.internal.inject.InjectionManager, org.glassfish.jersey.model.internal.ComponentBag, org.glassfish.jersey.spi.ExecutorServiceProvider, org.glassfish.jersey.spi.ScheduledExecutorServiceProvider)''. There is an issue already created for raising an awareness about this CVE : https://github.com/thelastpickle/cassandra-reaper/issues/1462'
- id: CGA-grw7-f4vj-7jvv
aliases:
- CVE-2024-29131
- GHSA-xjp4-hw94-mvp5
events:
- timestamp: 2024-04-16T07:21:07Z
type: detection
data:
type: scan/v1
data:
subpackageName: cassandra-reaper
componentID: 3d4c624182cd6049
componentName: commons-configuration2
componentVersion: "2.1"
componentType: java-archive
componentLocation: /usr/local/lib/cassandra-reaper.jar
scanner: grype
- timestamp: 2024-04-22T16:32:34Z
type: fixed
data:
fixed-version: 3.6.0-r0
- id: CGA-9pcx-658r-q6cc
aliases:
- CVE-2024-29133
- GHSA-9w38-p64v-xpmv
events:
- timestamp: 2024-04-16T07:21:04Z
type: detection
data:
type: scan/v1
data:
subpackageName: cassandra-reaper
componentID: 3d4c624182cd6049
componentName: commons-configuration2
componentVersion: "2.1"
componentType: java-archive
componentLocation: /usr/local/lib/cassandra-reaper.jar
scanner: grype
- timestamp: 2024-04-22T16:32:33Z
type: fixed
data:
fixed-version: 3.6.0-r0