CGA-c7jc-pc4g-5wpx

Published

Last updated

https://images.chainguard.dev/security/CGA-c7jc-pc4g-5wpx

Package

spark-3.5

RepositoryWolfi

Latest Update

Pending upstream fix

Aliases

Severity

6.5

Medium

CVSS CVSS_V3

References

Updates

Status

Pending upstream fix

Impact

This jetty-servlets dependency is brought in as a transitive dependency via spark-core_2.13-3.5.4.jar. These transitive dependencies from spark-core_2.13-3.5.4.jar are not able to be upgraded to a higher version and require upstream maintainers to implement.

Status

Under investigation

Status

Fixed

Fixed version

3.5.3-r4

Status

Under investigation

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.