-
Notifications
You must be signed in to change notification settings - Fork 3.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Whitesource vulnerabilities in eureka-client and eureka-server #1387
Comments
|
Done :) Thank you! |
Hi Team, I would like to create a new patch to address the issue, because eureka-server still has log4j-1.2.16.jar and jackson-dataformat-cbor-2.6.7.jar. I would like to upgrade all slf4j libraries to 1.7.35 (to get rid of log4j-1.2.16), upgrade all jackson libraries to 2.11.4 plus explicitly specify jackson-dataformat-cbor version (2.6.7 arrives from aws-java-sdk-core). Any objection? Best regards, |
Whitesource vulnerabilities in eureka-client and eureka-server (Netflix#1387)
Hi,
We are using eureka-client and eureka-server (version: 1.10.13) and we saw some vulnerabilities in your jars:
log4j-1.2.16.jar
jackson-dataformat-cbor-2.6.7.jar
xstream-1.4.15.jar
Do you know when those vulnerabilities will be fixed?
Thanks and have a nice day,
Amit.
The text was updated successfully, but these errors were encountered: