Update Derby - CVE-2022-46337

[PeterSuna]

Hi, Is it possible to fix this CVE-2022-46337 vulnerability here?
I don't have any information regarding any planned releases in the Derby 10.14.x branch.
The only known fixed version is Derby 10.17.1.0 for Java 21.

Thanks.

[grgrzybek]

Thanks for the report.
We're trying to keep Pax JDBC JDK8 compatible. So we can't simply update the version. But mind that this is an open source project and you can simply define your own Karaf feature of pax-jdbc-derby with better version once you decide to use JDK21 only.

And TBH I don't have clear vision of Pax JDBC 2.0 or 3.0...

Feel free to contribute ;)

[grgrzybek]

And as far as I understand CVE-2022-46337, it's about the server side (not the client/driver side) Derby.
Even in embedded mode it's not simply a LDAP-authenticated Derby installations.

So I don't even consider this (but I'm not a security expert) a problem for Pax JDBC itself.

[PeterSuna]

Okay, thank you for clarifying.