Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

There are fatal vulnerabilities in the lodash software that jdbc indirectly depends on. #217

Open
fengnian7 opened this issue Mar 21, 2021 · 2 comments
Open

There are fatal vulnerabilities in the lodash software that jdbc indirectly depends on. #217

fengnian7 opened this issue Mar 21, 2021 · 2 comments

Comments

@fengnian7
Copy link

Hi, I have some questions to ask.
In version 0.6.3 of the jdbc , there are fatal vulnerabilities in the dependent version 4.17.5 of lodash under java that jdbc directly depends on and under async of java. The two fatal vulnerabilities are CVE-2019-10744 and CVE-2020-36242 in version 4.17.5 of lodash. Do you have the plan to solve the vulnerabilities of lodash in the next version of jdbc?
Thanks.
@CraZySacX
Copy link
Owner

0.7.4 has been released back in January and lodash has been updated to 4.17.20.

@fengnian7
Copy link
Author

Thank you for your reply. lodash 4.17.20 version still has the two vulnerabilities but not 4.17.21 version

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@CraZySacX @fengnian7