There is a vulnerability in Guava: Google Core Libraries for Java 15.0 ,upgrade recommended

Netflix / Hystrix

Hystrix is a latency and fault tolerance library designed to isolate points of access to remote systems, services and 3rd party libraries, stop cascading failure and enable resilience in complex distributed systems where failure is inevitable.

23.98k stars 4.7k forks source link

There is a vulnerability in Guava: Google Core Libraries for Java 15.0 ,upgrade recommended #2018

Open QiAnXinCodeSafe opened 3 years ago

QiAnXinCodeSafe commented 3 years ago

https://github.com/Netflix/Hystrix/blob/3cb21589895e9f8f87cfcdbc9d96d9f63d48b848/hystrix-contrib/hystrix-javanica/build.gradle#L103

CVE-2018-10237 CVE-2020-8908

Recommended upgrade version： 24.1.1.jre