Fix CVE-2022-45688, CVE-2023-43642 (#3404)

* Fix CVE-2022-45688 Signed-off-by: Asif Sohail Mohammed <[email protected]> * Fix CVE-2023-43642 Signed-off-by: Asif Sohail Mohammed <[email protected]> --------- Signed-off-by: Asif Sohail Mohammed <[email protected]>
opensearch-project · Sep 29, 2023 · 57ac3b8 · 57ac3b8
1 parent b493355
commit 57ac3b8
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/build.gradle b/build.gradle
@@ -154,9 +154,9 @@ subprojects {
             }
             implementation('org.xerial.snappy:snappy-java') {
                 version {
-                    require '1.1.10.1'
+                    require '1.1.10.5'
                 }
-                because 'Fixes CVE-2023-35165, CVE-2023-34455, CVE-2023-34453, CVE-2023-34454, CVE-2023-2976'
+                because 'Fixes CVE-2023-43642'
             }
             implementation('com.squareup.okio:okio-jvm') {
                 version {
@@ -182,6 +182,12 @@ subprojects {
                 }
                 because 'CVE from transitive dependencies'
             }
+            implementation('org.json:json') {
+                version {
+                    require '20230618'
+                }
+                because 'CVE from transitive dependencies'
+            }
         }
     }