CGA-hcxh-3f34-3v4m

Published

Last updated

Package

druid

RepositoryWolfi

Latest Update

Not affected

Aliases

Severity

7.5

High

CVSS V3

Status

Not affected

Justification

Vulnerable code not in execute path

Impact

Upstream note that this is a false positive as it does not affect clients. See https://github.com/apache/druid/pull/13590

Status

Pending upstream fix

Impact

This vulnerability relates to protobuf-java 3.7.1, included by the shaded JAR hadoop-client-runtime-3.3.6.jar.

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™