opentracing-contrib / opentracing-contrib/java-spring-cloud
Update jaeger-client dependency due to CVE-2020-13949
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 399
- Forks
- 143
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 22
Description
You have an indirect dependency on libthrift:0.13.0 which has a security problem according to CVE-2020-13949.
Please update to opentracing-spring-jaeger-starter:3.3.3!
{noformat}
+--- io.opentracing.contrib:opentracing-spring-jaeger-cloud-starter:3.3.1
| +--- io.opentracing.contrib:opentracing-spring-jaeger-starter:3.3.1
| | --- io.jaegertracing:jaeger-client:1.3.2
| | +--- io.jaegertracing:jaeger-thrift:1.3.2
| | | +--- org.apache.thrift:libthrift:0.13.0
...
{noformat}
see also
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the project's dependency declarations and resolve the dependency tree shown in the issue, beginning with opentracing-spring-jaeger-cloud-starter:3.3.1. Confirm that the resolved libthrift version no longer includes 0.13.0 and run the repository's dependency or build checks; done when the requested 3.3.3 starter is used without the CVE-2020-13949 path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100