Details
-
Bug
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
2.7.3
Description
Remove dependency on org.springframework.security:spring-security-web 4.3.18.RELEASE in Ambari Server due to security concerns. See
https://nvd.nist.gov/vuln/detail/CVE-2018-15756
[INFO] Scanning for projects... [INFO] [INFO] ------------------< org.apache.ambari:ambari-server >------------------- [INFO] Building Ambari Server 2.7.3.0.0 [INFO] --------------------------------[ jar ]--------------------------------- [INFO] [INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ ambari-server --- ... [INFO] +- org.springframework:spring-web:jar:4.3.18.RELEASE:compile
Recommendation is to remove the dependency or upgrade to version 4.3.20.RELEASE or the latest version, if possible.
Attachments
Issue Links
- links to
