This message was deleted.
# generals
Slackbot
02/14/2023, 11:38 PMThis message was deleted.
👀 1
h
Harjit Singh
02/15/2023, 12:14 AMMotivation for the above is to address certain CVE's that are fixed in 1.32.0
a
Abhishek Agarwal
02/15/2023, 5:51 AMYou have tagged the wrong Abhishek 🙂
Abhishek Agarwal
02/15/2023, 5:51 AMwhich CVEs are those btw?
Abhishek Agarwal
02/15/2023, 5:53 AMWe do have plans to upgrade Calcite early this year. What's unknown is whether we can do it without shading calcite dependencies.
h
Harjit Singh
02/15/2023, 5:55 AMMy apologies!
This is the CVE of concern: CVE-2022-39135
a
Abhishek Agarwal
02/15/2023, 5:56 AMWe analyzed this CVE before and came to conclusion that druid is not affected by it.
m
Michael Schiff
02/15/2023, 5:57 AMdo the results of those analysis get posted somewhere in the repo as part of an exception on CVE checks?
h
Harjit Singh
02/15/2023, 5:58 AMI see this
Copy code
owasp-dependency-check-suppressions.xml
678: <cve>CVE-2022-39135</cve>
702: <cve>CVE-2022-39135</cve>
713: <cve>CVE-2022-39135</cve>m
Michael Schiff
02/15/2023, 5:58 AMyeah Ive seen this file, but the notes there are not really descriptive for why its suppressed
✅ 1
a
Abhishek Agarwal
02/15/2023, 5:58 AMAbhishek Agarwal
02/15/2023, 5:59 AMIt does say - "We do not expose any of the SQL operators that were found vulnerable in this CVE." what additional info would be useful there?
👀 1
m
Michael Schiff
02/15/2023, 6:00 AMmissed that on the first pass
h
Harjit Singh
02/15/2023, 6:08 AM@Abhishek Agarwal There was another one that had to with jackson-databind
CVE-2022-42003