[PUBDEV-9112] Fix CVE-2023-2976

h2oai · Jun 19, 2023 · 056a10b · 056a10b
1 parent 7bef068
commit 056a10b
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/h2o-assemblies/main/build.gradle b/h2o-assemblies/main/build.gradle
@@ -27,7 +27,8 @@ dependencies {
         api('com.fasterxml.jackson.core:jackson-databind:2.13.4.2') {
             because 'Fixes CVE-2022-42003'
         }
-        api('com.google.guava:guava:31.1-jre') {
+        api('com.google.guava:guava:32.0.1-jre') {
+            because 'Fixes CVE-2023-2976'
             because 'Fixes CVE-2020-8908'
             because 'Fixes CVE-2018-10237'
         }

diff --git a/h2o-assemblies/minimal/build.gradle b/h2o-assemblies/minimal/build.gradle
@@ -23,7 +23,8 @@ dependencies {
     api project(":h2o-persist-http")
 
     constraints {
-        api('com.google.guava:guava:31.1-jre') {
+        api('com.google.guava:guava:32.0.1-jre') {
+            because 'Fixes CVE-2023-2976'
             because 'Fixes CVE-2020-8908'
             because 'Fixes CVE-2018-10237'
         }

diff --git a/h2o-assemblies/steam/build.gradle b/h2o-assemblies/steam/build.gradle
@@ -76,7 +76,8 @@ dependencies {
         api('org.jetbrains.kotlin:kotlin-stdlib:1.4.32') {
             because 'Fixes CVE-2020-29582'
         }
-        api('com.google.guava:guava:31.1-jre') {
+        api('com.google.guava:guava:32.0.1-jre') {
+            because 'Fixes CVE-2023-2976'
             because 'Fixes CVE-2020-8908'
             because 'Fixes CVE-2018-10237'
         }