natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Switch lz4-java to at.yawk.lz4 version due to CVE 

Patch by Abe Ratnofsky; reviewed by Jyothsna Konisa, Dmitry Konstantinov for CASSANDRA-21052
This commit is contained in:
Abe Ratnofsky 2025-12-15 08:33:09 -08:00 committed by Abe Ratnofsky
parent 4c33f1f2d7
commit ec3b425c38
3 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
4.0.20 4.0.20
* Switch lz4-java to at.yawk.lz4 version due to CVE (CASSANDRA-20152)
* Restrict BytesType compatibility to scalar types only (CASSANDRA-20982) * Restrict BytesType compatibility to scalar types only (CASSANDRA-20982)
* Backport fix to nodetool gcstats output for direct memory (CASSANDRA-21037) * Backport fix to nodetool gcstats output for direct memory (CASSANDRA-21037)
* ArrayIndexOutOfBoundsException with repaired data tracking and counters (CASSANDRA-20871) * ArrayIndexOutOfBoundsException with repaired data tracking and counters (CASSANDRA-20871)

9
NEWS.txt
View File

@ -51,6 +51,15 @@ restore snapshots created with the previous major version using the
'sstableloader' tool. You can upgrade the file format of your snapshots 'sstableloader' tool. You can upgrade the file format of your snapshots
using the provided 'sstableupgrade' tool. using the provided 'sstableupgrade' tool.
4.0.20
======
Upgrading
---------
- This release addresses a security vulnerability in the LZ4 dependency, documented in CASSANDRA-21052. For users
who did not use LZ4 native libraries, this will now fallback to a safer but less performant pure Java
implementation. During startup, a warning will be logged if the LZ4 native library is not available.
4.0.14 4.0.14
====== ======

4
build.xml
View File

@ -546,7 +546,7 @@
<scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/> <scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/>
<dependencyManagement> <dependencyManagement>
<dependency groupId="org.xerial.snappy" artifactId="snappy-java" version="1.1.10.4"/> <dependency groupId="org.xerial.snappy" artifactId="snappy-java" version="1.1.10.4"/>
<dependency groupId="org.lz4" artifactId="lz4-java" version="1.8.0"/> <dependency groupId="at.yawk.lz4" artifactId="lz4-java" version="1.10.1"/>
<dependency groupId="com.github.luben" artifactId="zstd-jni" version="1.5.7-2"/> <dependency groupId="com.github.luben" artifactId="zstd-jni" version="1.5.7-2"/>
<dependency groupId="com.google.guava" artifactId="guava" version="27.0-jre"> <dependency groupId="com.google.guava" artifactId="guava" version="27.0-jre">
<exclusion groupId="com.google.code.findbugs" artifactId="jsr305" /> <exclusion groupId="com.google.code.findbugs" artifactId="jsr305" />
@ -805,7 +805,7 @@
relativePath="${final.name}-parent.pom"/> relativePath="${final.name}-parent.pom"/>
<scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/> <scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/>
<dependency groupId="org.xerial.snappy" artifactId="snappy-java"/> <dependency groupId="org.xerial.snappy" artifactId="snappy-java"/>
<dependency groupId="org.lz4" artifactId="lz4-java"/> <dependency groupId="at.yawk.lz4" artifactId="lz4-java"/>
<dependency groupId="com.google.guava" artifactId="guava"/> <dependency groupId="com.google.guava" artifactId="guava"/>
<dependency groupId="commons-cli" artifactId="commons-cli"/> <dependency groupId="commons-cli" artifactId="commons-cli"/>
<dependency groupId="commons-codec" artifactId="commons-codec"/> <dependency groupId="commons-codec" artifactId="commons-codec"/>