Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade quartz dependency #5847

Open
kalaiyarasiganeshalingam opened this issue Dec 1, 2023 · 0 comments
Open

Upgrade quartz dependency #5847

kalaiyarasiganeshalingam opened this issue Dec 1, 2023 · 0 comments

Comments

@kalaiyarasiganeshalingam
Copy link
Contributor

Description:
The existing package uses Quartz 2.3.2. But there is a vulnerability issue with this quartz. This problem comes from the method org.quartz.jobs.ee.jms.SendQueueMessageJob.execute(JobExecutionContext), which is designed to send JMS messages. According to the Quartz release thread[1], this vulnerability only affects if we expose a connection factory that must be configured by the user. Otherwise, there is no way the problem will be affected. Since the task module does not use this functionality, there is no problem with the task package.

Quartz has fixed this issue but they haven't released any stable version. We should upgrade the package when Quartz releases a new stable version.

[1] quartz-scheduler/quartz#943

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant