[NIFI-11356] Upgrade Nimbus JOSE JWT to 9.31 - ASF JIRA

XML

Word

Printable

JSON

Details

Type: Improvement
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 2.0.0-M1, 1.21.0
Component/s: Core Framework, Extensions, NiFi Registry
Labels:
- dependency-upgrade

Description

Nimbus JOSE JWT version 9 prior to 9.24.0 include a shaded version of JSON Smart 2.4.8, which is vulnerable to resource exhaustion as described in CVE-2023-1370. More recent versions of Nimbus JOSE JWT depend on Gson and are not subject to the vulnerability.

Attachments

Issue Links

links to

GitHub Pull Request #7096

Activity

People

Assignee:: David Handermann

Reporter:: David Handermann

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 28/Mar/23 18:30

Updated:: 28/Mar/23 21:23

Resolved:: 28/Mar/23 21:23

Time Tracking

Estimated:

Not Specified

Remaining:

Logged:

20m