[IGNITE-8984] Ignite 2.5 - Vulnerabilities

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8
• Labels: security vulnerability
• Flags: Important
• Assignee: Dmitry Pavlov
• Reporter: Segu Riluvan
• Created: 11/Jul/18 16:05
• Updated: 22/Apr/20 11:37
• Resolved: 22/Apr/20 08:00

Description

Recently we have scanned Apache Ignite 2.5 source code and all the associated maven packages using Blackduck. The scan identified with many of the dependencies for Ignite 2.5. Many of these vulnerabilities are rated as High risk vulnerabilities. I've attached the vulnerability report to this ticket.

 

Issue Links

• incorporates: IGNITE-9035 Update log4j 2x version in Apache Ignite
• incorporates: IGNITE-9036 Update FasterXML jackson-databind dependency version in Apache Ignite
• incorporates: IGNITE-9046 Actualize dependency versions for Cassandra Cache Store
• incorporates: IGNITE-9057 Update JCraft dependency version in Apache Ignite
• incorporates: IGNITE-9058 Update Apache Tomcat dependency version
• incorporates: IGNITE-9073 Ignite modules should use jackson2 dependency rater then jackson1
• incorporates: IGNITE-9349 Update Spring Data 2x and 1x and Spring 5x and 4x versions
• incorporates: IGNITE-9123 Update Apache commons-collections in ignite-yarn module
• incorporates: IGNITE-9126 Update Apache Kafka dependency
• incorporates: IGNITE-9131 Upgrade guava version in Apache Ignite
• incorporates: IGNITE-9132 Update Apache Camel dependency version
• is related to: IGNITE-9340 Update Jetty version in Apache Ignite (ignite-rest-http)
• relates to: IGNITE-9495 Upgrade lucene dependency version.