-
Notifications
You must be signed in to change notification settings - Fork 5.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix CVEs about h2database #24001
base: master
Are you sure you want to change the base?
Fix CVEs about h2database #24001
Conversation
Consider a release note entry like the following:
|
672f3f0
to
f2670d4
Compare
f2670d4
to
a442074
Compare
e7ac362
to
07d24ed
Compare
pom.xml
Outdated
@@ -1180,7 +1180,7 @@ | |||
<dependency> | |||
<groupId>com.h2database</groupId> | |||
<artifactId>h2</artifactId> | |||
<version>1.4.199</version> | |||
<version>1.4.200</version> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let us know if you were able to figure out the root cause of the issue we discussed internally.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ya I found the issue. H2db version 1.4.200 only support the start date from "1890-09-30". If i am give above that this date then test cases will pass.
Reference link : h2database/h2database#2261
Currently i am trying to upgrade the version as 2.2.220, which has no vulnerabilities.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good find. :D
Hi @ShahimSharafudeen is this PR ready for review now? If so, please mark it as ready for review. |
27e59e6
to
359b804
Compare
No. One more test failure scenario also needs to fix. |
Description
Fixes CVE-2022-23221 , CVE-2021-23463 and CVE-2021-42392 on com.h2database:h2.
Motivation and Context
Resolve a new CVE.
Impact
Should have no known impact to other code.
Test Plan
Regular PR GitHub actions
Contributor checklist
Release Notes
Please follow release notes guidelines and fill in the release notes below.