[DERBY-7135] Does derby 10.14.2.0 contain the CVE-2020-13949 vulnerability?

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Not A Problem
• Affects Version/s: 10.14.2.0
• Urgency: Blocker

Language

Java

• Assignee: Unassigned
• Reporter: JenickLee
• Created: 21/Mar/22 16:49
• Updated: 22/Mar/22 13:42
• Resolved: 22/Mar/22 13:42

Description

Use a security tool to scan the derby 10.14.2.0 installation package. The result shows that derbynet.jar contains the CVE-2020-13949 vulnerability. The vulnerability is related to  Hive and Thrift, but no reference is found in the derby 10.14.2.0 source code.

Is it a false positive? Which of the following application scenarios will be affected if the vulnerability is involved?

For details about the scanning result, see the attachment.

Vulnerability Details:

https://nvd.nist.gov/vuln/detail/CVE-2020-13949