Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Fix for Lucene-core PRISMA-2021-0081 #23688

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

imsayari404
Copy link

Description

Security fix for Lucene-core
Fixed - 1 High
vulnerable version : 8.2.0
Fixed version : 8.10.0
excluded the higher version because local source build was breaking.

Motivation and Context

Reasons to exclude:

  1. Apache Lucene is vulnerable to ReDos, the regex engine in Lucene can take long time and high CPU usage before
    determining the total count for the states of a regex.

Impact

Image scan showed the vulnerability has been removed
Image scan report :
correlation-report-ibm-lh-presto lucene 10th.csv

Test Plan

Tested in 3 form factor : Cpd,Dev and SaaS

Contributor checklist

  • Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

General Changes
* ... :pr:`12345`
* ... :pr:`12345`

Hive Connector Changes
* ... :pr:`12345`
* ... :pr:`12345`

If release note is NOT required, use:

== NO RELEASE NOTE ==

Copy link

CLA Missing ID CLA Not Signed

@elharo
Copy link
Contributor

elharo commented Sep 20, 2024

Thanks, please sign the CLA

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants