cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Help
Data Engineering
Join discussions on data engineering best practices, architectures, and optimization strategies within the Databricks Community. Exchange insights and solutions with fellow data engineers.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Databricks-jdbc and vulnerabilities CVE-2021-36090 CVE-2023-6378 CVE-2023-6481

karthik-kobai
New Contributor II

‎02-06-2024 11:18 AM

The latest version of Databricks-jdbc available through Maven (2.6.36) now has these three vulnerabilities:

https://www.cve.org/CVERecord?id=CVE-2021-36090
https://www.cve.org/CVERecord?id=CVE-2023-6378
https://www.cve.org/CVERecord?id=CVE-2023-6481

All due to depending on and including in the jar the older versions of the below jar dependencies

org.apache.commons:commons-compress@1.20
ch.qos.logback:logback-classic@1.2.3
ch.qos.logback:logback-core@1.2.3

Is there a possibility to have a new updated version of Databricks-jdbc that uses the latest of these dependent jars?

org.apache.commons:commons-compress@1.25
ch.qos.logback:logback-classic@1.2.13 or @1.4.14
ch.qos.logback:logback-core@1.2.13 or @1.4.14

0 Kudos
0 REPLIES 0

Connect with Databricks Users in Your Area

Join a Regional User Group to connect with local Databricks users. Events will be happening in your city, and you won’t want to miss the chance to attend and share knowledge.

If there isn’t a group near you, start one and help create a community that brings people together.

Request a New Group
Announcements