[CASSANDRA-18122] when will slf4j be upgraded for CVE-2018-8088

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Not A Problem
• Platform: All
• Assignee: Unassigned
• Reporter: Jai Bheemsen Rao Dhanwada
• Created: 15/Dec/22 21:50
• Updated: 15/Dec/22 22:10
• Resolved: 15/Dec/22 21:59

Description

Hello Team,

I see Cassandra 4.1 GA'ed on 12/13/2022 and still uses 1.7.25 version of slf4j and the vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2018-8088 is fixed only in the 1.7.26 version. Do we have any details on when the slf4j be upgraded ?