samtools / htsjdk

A Java API for high-throughput sequencing data (HTS) formats.
http://samtools.github.io/htsjdk/
276 stars 244 forks source link

Update snappy-java and migrate mjson to org.json to address CVEs #1670

Closed bbimber closed 11 months ago

bbimber commented 1 year ago

There are CVEs reported for mjson, which does not appear to be an actively maintained project:

https://nvd.nist.gov/vuln/detail/CVE-2023-34611 https://github.com/bolerio/mjson/issues/40

and also snappy-java:

https://nvd.nist.gov/vuln/detail/CVE-2023-34453 https://nvd.nist.gov/vuln/detail/CVE-2023-34455

the latest snappy-java has been patched.

This PR does two things:

lbergelson commented 12 months ago

@bbimber Thank you!

bbimber commented 11 months ago

@lbergelson were there any other changes you needed on this? Also, and this isnt urgent, but is there a defined release schedule on htsjdk? Thanks.

lbergelson commented 11 months ago

Ack, I had it set to rebase instead of squash. Sorry for commit spam.

lbergelson commented 11 months ago

Thanks for doing this. I was thinking of doing a release very soon.