Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for: CVE-2024-47554 #4791

Merged
merged 2 commits into from
Oct 7, 2024
Merged

Conversation

derek-ho
Copy link
Collaborator

@derek-ho derek-ho commented Oct 7, 2024

Description

Fix: CVE-2024-47554 by bumping to the latest version of commons:io (2.17)

Issues Resolved

Fix: #4790

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.
No

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here
No

Testing

None

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Derek Ho <[email protected]>
Copy link

codecov bot commented Oct 7, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.97%. Comparing base (f661884) to head (4f69524).
Report is 1 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #4791      +/-   ##
==========================================
+ Coverage   67.94%   67.97%   +0.03%     
==========================================
  Files         310      310              
  Lines       20927    20927              
  Branches     3322     3322              
==========================================
+ Hits        14218    14226       +8     
+ Misses       4957     4949       -8     
  Partials     1752     1752              

see 3 files with indirect coverage changes

@derek-ho derek-ho marked this pull request as ready for review October 7, 2024 18:39
@derek-ho derek-ho changed the title Fix Fix for: CVE-2024-47554 Oct 7, 2024
@willyborankin willyborankin added the backport 2.x backport to 2.x branch label Oct 7, 2024
@willyborankin willyborankin merged commit 903b7b3 into opensearch-project:main Oct 7, 2024
38 of 39 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Oct 7, 2024
Signed-off-by: Derek Ho <[email protected]>
(cherry picked from commit 903b7b3)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 2.x backport to 2.x branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2024-47554 (High) detected in commons-io-2.11.0.jar
4 participants