Security Vulnerability in Logback Classic Module (CVE-2017-5929)

janusgraph-es and janusgraph-solr have a dependency (ch.qos.logback:logback-core:1.1.2) which has a vulnerability described in https://nvd.nist.gov/vuln/detail/CVE-2017-5929.

[info] ch.qos.logback:logback-core:1.1.2
[info] +-ch.qos.logback:logback-classic:1.1.2
[info] +-org.janusgraph:janusgraph-es:0.3.0
[info] |
[info] +-org.janusgraph:janusgraph-solr:0.3.0

According to https://logback.qos.ch/news.html, version 1.2.0 "fixes a rather severe serialization vulnerability in SocketServer and ServerSocketReceiver". This may be as simple as increasing the version.

Start by tracing the dependency declarations for the janusgraph-es and janusgraph-solr modules and inspect how logback-core 1.1.2 is resolved through logback-classic. Update the dependency to a version that addresses CVE-2017-5929, then verify the resolved dependency tree no longer contains the vulnerable version.

Written by the indexing model from the issue text.