snowflakedb / snowflakedb/snowflake-ingest-java
Snyk: snowflake-ingest-java org.apache.commons:commons-compress 1.22 | Snyk ID - SNYK-JAVA-ORGAPACHECOMMONS-6254297
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 83
- Forks
- 70
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 6
Description
Title: Snyk: snowflake-ingest-java org.apache.commons:commons-compress 1.22
Additional information on Snyk can be found here: https://snyk.io/org/snowflakedb-sca-scanning-public-repo/project/0a0b0a8c-113f-4e60-98d3-357b27f5338d
Repo: snowflake-ingest-java
CVE: CVE-2024-26308
Package Type: java
Package Name: org.apache.commons:commons-compress
Package Version: 1.22
Snyk ID: SNYK-JAVA-ORGAPACHECOMMONS-6254297
Vulnerability URL: http://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-6254297
Severity: medium
Introduced Date: 2025-04-10
Projects with Vulnerability: snowflakedb/snowflake-ingest-java:e2e-jar-test/core/pom.xml
Target File: e2e-jar-test/core/pom.xml
JIRA Ticket: https://snowflakecomputing.atlassian.net/browse/SNOW-2036535
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with e2e-jar-test/core/pom.xml and review the commons-compress dependency at version 1.22. Check the CVE-2024-26308 advisory or Snyk report to identify a non-vulnerable compatible version, then run the relevant e2e JAR tests. Done means the vulnerable dependency is no longer reported and the tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100