natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

CVE-2017-5929 Security vulnerability in Logback warning in NEWS.txt 

Patch by Ariel Weisberg; Reviewed by Jason Brown for CASSANDRA-14183
This commit is contained in:
Ariel Weisberg 2018-02-14 11:55:00 -05:00
parent b2949439ec
commit 4bbd28a043
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES.txt
View File

@ -1,3 +1,6 @@
2.1.21
* CVE-2017-5929 Security vulnerability in Logback warning in NEWS.txt (CASSANDRA-14183)
2.1.20
* Protect against overflow of local expiration time (CASSANDRA-14092)
* More PEP8 compliance for cqlsh (CASSANDRA-14021)

9
NEWS.txt
View File

@ -18,6 +18,15 @@ CASSANDRA-14092.txt file.
If you use or plan to use very large TTLS (10 to 20 years), read CASSANDRA-14092.txt
for more information.
PLEASE READ: CVE-2017-5929 LOGBACK BEFORE 1.2.0 SERIALIZATION VULNERABILITY
------------------------------------------------------------------
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the
SocketServer and ServerSocketReceiver components.
Logback has not been upgraded to avoid breaking deployments and customizations
based on older versions. If you are using vulnerable components you will need
to upgrade to a newer version of Logback or stop using the vulnerable components.
GENERAL UPGRADING ADVICE FOR ANY VERSION
========================================