Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-18243

Upgrade Guava for 31.1 to 32.1.1 (resolves CVE-2023-2976)

    XMLWordPrintable

Details

    Description

      Our current guava release has a CVE (CVE-2023-2976); update it.

      Moving to 32.0.1 is sufficient to resolve the CVE but it seems reasonable to go to the latest release, 32.1.1.

       

      31.1 -> 32.1.1 https://github.com/google/guava/compare/v31.1...v32.1.1

      31.1 -> 32.0.1 https://github.com/google/guava/compare/v31.1...v32.0.1

      32.0.1 -> 32.1.1 https://github.com/google/guava/compare/v32.0.1...v32.1.1

       

      Attachments

        Issue Links

          is cloned by

          Task - Represents a small unit of work that is not end-user facing. JBERET-592 Upgrade Guava for 31.1 to 32.1.1 (resolves CVE-2023-2976)

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Resolved

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-25356 (8.0.0) Upgrade Guava from 31.1.0.jre-redhat-00001 to 32.1.1.jre-redhat-00001

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Closed

          Activity

            People

              bstansbe@redhat.com Brian Stansberry
              bstansbe@redhat.com Brian Stansberry
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: