search

grails / grails-quartz

This project provides integration of the Quartz scheduling framework into the Grails Framework
http://grails.org/plugin/quartz
Apache License 2.0
76 stars 90 forks source link

address CVE-2019-13990 by updating quartz from 2.2.3 to 2.3.2 #117

Closed mluckam closed 8 months ago

mluckam commented 1 year ago

The latest version of the grails quartz plugin, currently 2.0.13, has the vulnerability CVE-2019-13990. This issue is addressed by updating to quartz 2.3.2. Instead of users updating the dependency themselves, see example, this issue should be addressed in the plugin directly. Relevant links: quartz github issue maven central vulnerability

mluckam commented 1 year ago

This repository has been inactive for a few years. @puneetbehl it appears you are the latest maintainer. Mind taking a look?

mluckam commented 1 year ago

@puneetbehl are you able to take a look at this or refer me to another maintainer of the project?

mluckam commented 1 year ago

@puneetbehl are you able to take a look at this or refer me to another maintainer of the project?

mluckam commented 8 months ago

@Richardson-e @mattmoss @puneetbehl are you able to take a look at this?

puneetbehl commented 8 months ago

Sorry for the delayed response. Thank you for this PR. We are working on updating a new version of the Quatz plugin and wiil include all these changes. @Richardson-e Could you please add these changes to the latest codebase.