[IGNITE-8471] Apache ignite for .NET has security vulnerabilities

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4
• Fix Version/s: 2.5
• Component/s: security
• Labels: vulnerability
• Assignee: Andrey N. Gura
• Reporter: Harendra Rai
• Created: 11/May/18 13:23
• Updated: 22/Apr/20 08:35
• Resolved: 09/Jun/18 10:50

Description

There are two security vulnerabilities in the latest 2.4.0 version.

1. commons-beanutils-1.8.3.jar.  Here is the vulnerability id CVE-2014-0114 :  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114

Resolution to this issue is: All Commons BeanUtils users should upgrade to the latest version >= commons-beanutils-1.9.2

1. commons-codec-1.6.jar: Here is the vulnerability detail https://issues.apache.org/jira/browse/CODEC-96

Resolution to this issue is: To upgrade to the latest available Version 1.11

Issue Links

• is duplicated by: IGNITE-8472 Apache ignite for .NET has security vulnerabilities
• links to: GitHub Pull Request #3984