[CASSANDRA-16734] Remediate Cassandra 3.11.10 JAR dependency vulnerabilities

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Invalid
• Fix Version/s: 3.11.11
• Component/s: Dependencies
• Platform: All
• Assignee: Unassigned
• Reporter: Daniel Gomez
• Created: 11/Jun/21 17:00
• Updated: 01/Aug/21 11:07
• Resolved: 11/Jun/21 18:51

Description

Several JAR dependencies are flagged in Cassandra 3.11.10 as having vulnerabilities that have been fixed in newer releases.
The following is the Cassandra 3.11.10 source tree for their JAR dependencies: https://github.com/apache/cassandra/tree/181a4969290f1c756089b2993a638fe403bc1314/lib

A possible fix strategy is to simply update the JARs to their newest version. See the JAR files available for each vulnerable library:

• See https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.9.10.8
• See https://mvnrepository.com/artifact/io.netty/netty-all/4.1.65.Final
• See https://mvnrepository.com/artifact/org.apache.thrift/libthrift/0.9.3-1
• See https://mvnrepository.com/artifact/com.thinkaurelius.thrift/thrift-server/0.3.9
• See https://mvnrepository.com/artifact/com.google.guava/guava/30.1.1-jre
• See https://mvnrepository.com/artifact/ch.qos.logback/logback-core/1.2.3
• See https://mvnrepository.com/artifact/org.yaml/snakeyaml/1.29
• See https://mvnrepository.com/artifact/commons-codec/commons-codec/1.15

Issue Links

• duplicates: CASSANDRA-16463 high and critical CVEs io.netty to 4.1.42.Final to fix critical and high vulnerabilities
• duplicates: CASSANDRA-16462 Upgrade to Jackson Databind 2.9.10.8 or later fix high vulnerabilities
• is cloned by: CASSANDRA-16741 Remediate Cassandra 3.11.10 JAR dependency vulnerability - com.google.guava_guava
• is cloned by: CASSANDRA-16738 Remediate Cassandra 3.11.10 JAR dependency vulnerability - org.yaml_snakeyaml
• is cloned by: CASSANDRA-16739 Remediate Cassandra 3.11.10 JAR dependency vulnerability - org.apache.thrift_libthrift
• is cloned by: CASSANDRA-16740 Remediate Cassandra 3.11.10 JAR dependency vulnerability - ch.qos.logback_logback-core
• is cloned by: CASSANDRA-16742 Remediate Cassandra 3.11.10 JAR dependency vulnerability - commons-codec_commons-codec
• is cloned by: CASSANDRA-16743 Remediate Cassandra 3.11.10 JAR dependency vulnerability - com.thinkaurelius.thrift_thrift-server