[CASSANDRA-18146] commons-cli vulnerability: CVE-2021-37533

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.29, 3.11.15, 4.0.8, 4.1.1, 5.0-alpha1, 5.0
• Component/s: Dependencies
• Bug Category: Security
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: 3.0.28

Source Control Link

https://github.com/apache/cassandra/commit/e0e63f44155a00a540407b402a6cae8480aa2c32

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 11/Jan/23 20:47
• Updated: 12/Sep/23 13:02
• Resolved: 17/Jan/23 16:02

Description

This CVE is being reported by the OWASP scan for:

commons-cli-1.1.jar: CVE-2021-37533
commons-codec-1.9.jar: CVE-2021-37533
commons-math3-3.2.jar: CVE-2021-37533

additionally commons-lang3-3.1.jar is also reported on 3.x.