3.3
CVSS V3
Status
Impact
Clickhouse-jdbc has a transitive dependency of guava that needs to be updated in clickhouse-jdbc. Subsequently, trino will have to update clickhouse-jdbc
Status
Status
Fixed version
439-r0Status
Impact
The upstream project relies on a number of "shaded JARs", making it harder to update dependencies. The upstream project will need to migrate away from a number of shaded JARs, including: "gcs-connector-hadoop3-2.2.17-shaded.jar" and "rubix-presto-shaded-0.3.18.jar" for this vulnerability to be resolved.
Status
Impact
We have determined that the offending java class is included in the package via a number of shaded JARs.