/
DirectorySecurity AdvisoriesPricing
Sign in
Security Advisories

CGA-gghr-qw4h-4xq9

Published

Last updated

https://images.chainguard.dev/security/CGA-gghr-qw4h-4xq9
Package

trino

RepositoryWolfi
Latest Update
Pending upstream fix
Aliases
  • CVE-2023-2976
  • GHSA-7g45-4rm6-3mm3

Severity

7.1

High

CVSS CVSS_V3

References

  • https://nvd.nist.gov/vuln/detail/CVE-2023-2976

Updates

Status

Pending upstream fix

Impact

Clickhouse-jdbc has a transitive dependency of guava that needs to be updated in clickhouse-jdbc. Subsequently, trino will have to update clickhouse-jdbc

Status

Under investigation

Status

Fixed

Fixed version

439-r0

Status

Pending upstream fix

Impact

The upstream project relies on a number of "shaded JARs", making it harder to update dependencies. The upstream project will need to migrate away from a number of shaded JARs, including: "gcs-connector-hadoop3-2.2.17-shaded.jar" and "rubix-presto-shaded-0.3.18.jar" for this vulnerability to be resolved.

Status

Affected

Impact

We have determined that the offending java class is included in the package via a number of shaded JARs.


Safe Source for Open Sourceâ„¢
Contact us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard ContainersChainguard LibrariesChainguard VMsIntegrationsPricing