Update dependencies to mitigate scanner-detected vulnerabilities #266
Conversation
Hi folks, I don't know if this naive change actually works by itself, but if it does and it's not too much trouble, could you publish a new version that mitigates this vulnerability? It's marked in scanners as 'critical' which makes it a bit problematic for us to use. See: https://grafana.com/security/security-advisories/cve-2024-8986/
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
Mitigates these 'high' severity vulnerabilities caught by Trivy: - https://avd.aquasec.com/nvd/cve-2023-47108 - https://avd.aquasec.com/nvd/cve-2023-45142 - https://avd.aquasec.com/nvd/cve-2023-39325 - GHSA-m425-mq94-257g
|
Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to [email protected]. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla |
robmoore-i
changed the title
|
Closing in favour of #244 |
Hi folks,
I don't know if this naive change actually works by itself, but if it does and it's not too much trouble, could you publish a new version that mitigates this vulnerability? It's marked in scanners as 'critical' which makes it a bit problematic for us to use.
The Grafana vulnerability in question: https://grafana.com/security/security-advisories/cve-2024-8986/