Protobuf-java-3.23.3 is vulnerable in opensearch-2.11.1.jar

bimlesh_singh · October 30, 2024, 11:49am

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

opensearch-2.11.1.jar

Describe the issue:
protobuf-java-3.23.3 is vulnerable in opensearch-2.11.1.jar and the latest version 2.17.1 .So do we have anytime line for upgrading the mentioned jar

Configuration:
opensearch-2.11.1.jar

Relevant Logs or Screenshots:

github.com

opensearch-project/OpenSearch/blob/2.11.1/buildSrc/version.properties

opensearch        = 2.11.1
lucene            = 9.7.0

bundled_jdk_vendor = adoptium
bundled_jdk = 17.0.8+7

# optional dependencies
spatial4j         = 0.7
jts               = 1.15.0
jackson           = 2.15.2
jackson_databind  = 2.15.2
snakeyaml         = 2.1
icu4j             = 70.1
supercsv          = 2.4.0
log4j             = 2.20.0
slf4j             = 1.7.36
asm               = 9.6
jettison          = 1.5.4
woodstox          = 6.4.0
kotlin            = 1.7.10

This file has been truncated. show original

Topic		Replies	Views
Is this an issue with Opensearch or the Security plugin? Upgrading from 2.17.1 to 2.18.0 General Feedback	19	230	December 7, 2024
OpenJDK version update Build discuss	4	815	January 18, 2022
Version must be upgraded to [8.11.1] is still set to [8.10.1] OpenSearch Client Libraries opensearch-java	0	607	November 17, 2022
2.13.1 compatible plugins Cross-Cluster Replication	3	130	June 24, 2024
Is the new opensearch-java client v.2.9.0 supposed to work with Java 8? OpenSearch Client Libraries opensearch-java	2	512	April 26, 2024

Protobuf-java-3.23.3 is vulnerable in opensearch-2.11.1.jar

Related topics