Security Vulnerability in Ganglia Integration For Metrics (CVE-2007-6465)

janusgraph-core has a dependency (com.codahale.metrics:metrics-ganglia:3.0.1) which has a vulnerability described in https://nvd.nist.gov/vuln/detail/CVE-2007-6465.

[info] com.codahale.metrics:metrics-ganglia:3.0.1
[info] +-org.janusgraph:janusgraph-core:0.3.0

3.0.2 is the latest version for com.codahale.metrics. The new package is io.dropwizard.metrics which requires code changes. com.codahale.metrics.metrics-core and com.codahale.metrics.metrics-graphite may also need to be ugpraded.

Start by locating the janusgraph-core dependency declarations and usages of metrics-ganglia, metrics-core, and metrics-graphite. Review the migration from com.codahale.metrics to io.dropwizard.metrics, then verify that the vulnerable Ganglia dependency is upgraded and the affected integration still builds and passes its available tests.

Written by the indexing model from the issue text.