natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'cassandra-4.1' into cassandra-5.0

This commit is contained in:
Stefan Miklosovic 2025-09-26 16:08:23 +02:00
parent b23db408c5 4757411e94
commit ed04f46b27
No known key found for this signature in database
GPG Key ID: 32F35CB2F546D93E
3 changed files with 23 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.build/build-owasp.xml
View File

@ -19,7 +19,7 @@
<project basedir="." name="apache-cassandra-owasp-tasks"
xmlns:unless="ant:unless"
xmlns:if="ant:if">
<property name="dependency-check.version" value="12.1.0"/>
<property name="dependency-check.version" value="12.1.6"/>
<property name="dependency-check.home" value="${tmp.dir}/dependency-check-ant-${dependency-check.version}"/>
<property name="dependency-check.archive.dir" value="${local.repository}/org/owasp/dependency-check-ant/${dependency-check.version}"/>
<property name="dependency-check.archive.name" value="dependency-check-ant-${dependency-check.version}-release.zip"/>

14
.build/owasp/dependency-check-suppressions.xml
View File

@ -21,15 +21,17 @@
-->
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- https://issues.apache.org/jira/browse/CASSANDRA-18943 -->
<!-- https://issues.apache.org/jira/browse/CASSANDRA-20924 -->
<suppress>
<packageUrl regex="true">^pkg:maven/io\.netty/netty\-.*@.*$</packageUrl>
<cve>CVE-2023-44487</cve>
</suppress>
<!-- https://issues.apache.org/jira/browse/CASSANDRA-20504 -->
<suppress>
<packageUrl regex="true">^pkg:maven/io\.netty/netty\-.*@.*$</packageUrl>
<cve>CVE-2025-24970</cve>
<cve>CVE-2025-25193</cve>
<cve>CVE-2024-29025</cve>
<cve>CVE-2023-44487</cve>
<cve>CVE-2024-47535</cve>
<cve>CVE-2025-55163</cve>
<cve>CVE-2025-58056</cve>
<cve>CVE-2025-58057</cve>
</suppress>
<!-- https://issues.apache.org/jira/browse/CASSANDRA-19142 -->

16
.snyk
View File

@ -3,7 +3,7 @@
version: v1.25.0
ignore:
CVE-2023-44487:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2023-6378:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2023-6481:
@ -12,7 +12,19 @@ ignore:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-12801:
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
CVE-2024-29025:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2024-45772:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20024 -- ^pkg:maven/org\.apache\.lucene/lucene\-.*@9.7.0$
CVE-2024-47535:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-24970:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-25193:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20504 -- ^pkg:maven/io\.netty/netty\-.*@.*$
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-55163:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-58056:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$
CVE-2025-58057:
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20924 -- ^pkg:maven/io\.netty/netty\-.*@.*$