opendev/gerrit
Code Issues Proposed changes

Upgrade commons-compress to 1.18 and tukaani xz to 1.8

Browse Source 
This version of commons-compress includes fixes for CVE-2018-1324 [1]
and CVE-2018-11771 [2].

Also update tukaani xz to 1.8, which is the version used by
commons-compress 1.18.

[1] https://nvd.nist.gov/vuln/detail/CVE-2018-1324
[2] https://nvd.nist.gov/vuln/detail/CVE-2018-11771

Change-Id: I4bf8ccc239445f20794844e6ea96005d7c8b9c77
This commit is contained in:
David Pursehouse
2018-09-28 13:15:29 +09:00
committed by Jonathan Nieder
parent 6b932e16b2
commit 1dae690008
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
WORKSPACE
View File

@@ -315,8 +315,8 @@ maven_jar(
# When upgrading commons-compress, also upgrade tukaani-xz
maven_jar(
name = "commons-compress",
artifact = "org.apache.commons:commons-compress:1.15",
sha1 = "b686cd04abaef1ea7bc5e143c080563668eec17e",
artifact = "org.apache.commons:commons-compress:1.18",
sha1 = "1191f9f2bc0c47a8cce69193feb1ff0a8bcb37d5",
)
maven_jar(