natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Suppress CVE-2024-45772 lucene-core-9.7.0.jar 

CVE in Lucene Replicator which the project doesn't use.

 patch by Mick Semb Wever; reviewed by Brandon Williams, Caleb Rackliffe for CASSANDRA-20024
This commit is contained in:
mck 2024-10-24 15:09:18 +02:00
parent 5e4ff921af
commit 3550b88307
No known key found for this signature in database
GPG Key ID: E91335D77E3E87CB
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.build/owasp/dependency-check-suppressions.xml
View File

@ -57,4 +57,10 @@
<cve>CVE-2023-6378</cve>
<cve>CVE-2023-6481</cve>
</suppress>
<!-- https://issues.apache.org/jira/browse/CASSANDRA-20024 -->
<suppress>
<packageUrl regex="true">^pkg:maven/org\.apache\.lucene/lucene\-.*@9.7.0$</packageUrl>
<cve>CVE-2024-45772</cve>
</suppress>
</suppressions>

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
5.0.3
* Suppress CVE-2024-45772 from lucene-core-9.7.0.jar (CASSANDRA-20024)
Merged from 4.1:
Merged from 4.0:
* Add configurable batchlog endpoint strategies: random_remote, prefer_local, dynamic_remote, and dynamic (CASSANDRA-18120)