Skip to content

ARROW-1240: [JAVA] security: upgrade logback to address CVE-2017-5929 (take 2) #960

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 6 commits into from
Closed

ARROW-1240: [JAVA] security: upgrade logback to address CVE-2017-5929 (take 2) #960

wants to merge 6 commits into from

Conversation

@mattdarwin
Copy link

sorry, this was still not fixed properly. logback version is separately specified in 2 places.

Fixed properly this time.

@wesm
Copy link
Member

wesm commented Aug 11, 2017 •
edited
Loading

Can you change the PR title to start with ARROW-1240:? What are the impacts of this patch, because we have a 0.6.0 RC out. Do we need to cancel the RC?

@wesm wesm mentioned this pull request Aug 11, 2017
Closed
@mattdarwin mattdarwin changed the title [ARROW-2140] security: upgrade logback to address CVE-2017-5929 (take 2) [ARROW-1240] [JAVA] security: upgrade logback to address CVE-2017-5929 (take 2) Aug 11, 2017
@mattdarwin mattdarwin changed the title [ARROW-1240] [JAVA] security: upgrade logback to address CVE-2017-5929 (take 2) ARROW-1240: [JAVA] security: upgrade logback to address CVE-2017-5929 (take 2) Aug 11, 2017
@mattdarwin
Copy link
Author

mattdarwin commented Aug 11, 2017 •
edited
Loading

The impact of not including the patch is that we are potentially vulnerable to the "rather severe serialization vulnerability in SocketServer and ServerSocketReceiver". I'm not sure how big the exposure is, but I think it would be prudent to include this in 0.6.0, given that we are aware of it.

The impact of the change itself is none - everything should still work as before.

@wesm
Copy link
Member

wesm commented Aug 11, 2017

Right, but we would have to delay the release by several days, which has a concrete cost to languages other than Java. I would personally rather release 0.6.1 with the dependencies fixed than cancel the 0.6.0 RC (unless the vote fails for other reasons). If you feel strongly, please vote accordingly on the mailing list and we can discuss there.

wesm
wesm approved these changes Aug 11, 2017
View reviewed changes
Copy link
Member

@wesm wesm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1. I had to cancel the RC for other reasons, so merging this. Thanks @mattdarwin!

@asfgit asfgit closed this in b795e5c Aug 11, 2017
pribor pushed a commit to GlobalWebIndex/arrow that referenced this pull request Oct 24, 2025
@kou
ARROW-1240: [JAVA] security: upgrade logback to address CVE-2017-5929 …
a707be5 
…(take 2)

sorry, this was still not fixed properly.  logback version is separately specified in 2 places.

Fixed properly this time.

Author: Matt Darwin <(none)>
Author: Matt <mattdarwin@yahoo.co.uk>

Closes apache#960 from mattdarwin/ARROW-1240-upgrade-logback and squashes the following commits:

3492f66 [Matt Darwin] upgrading logback in tools/pom.xml
206b48d [Matt Darwin] Merge branch 'master' into ARROW-1240-upgrade-logback
284a4ce [Matt Darwin] Merge branch 'master' of https://github.com/apache/arrow
bc3b6a0 [Matt] Merge pull request #1 from apache/master
3e2f676 [Matt Darwin] Merge branch 'master' into ARROW-1240-upgrade-logback
caed163 [Matt Darwin] upgrading slf4j to 1.7.25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wesm wesm wesm approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mattdarwin @wesm