Merge branch 'cassandra-3.11' into cassandra-4.0

rtadepalli · Dec 6, 2023 · 8e5fc74 · 8e5fc74
2 parents e1b0b44 + 2e3d7e7
commit 8e5fc74
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
@@ -64,4 +64,13 @@
  <cve>CVE-2023-35116</cve>
  </suppress>
 
+ <!-- https://issues.apache.org/jira/browse/CASSANDRA-19142 -->
+ <suppress>
+ <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-core@.*$</packageUrl>
+ <cve>CVE-2023-6378</cve>
+ </suppress>
+ <suppress>
+ <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-classic@.*$</packageUrl>
+ <cve>CVE-2023-6378</cve>
+ </suppress>
 </suppressions>
diff --git a/CHANGES.txt b/CHANGES.txt
@@ -22,6 +22,7 @@ Merged from 3.11:
  * Fix NPE when using udfContext in UDF after a restart of a node (CASSANDRA-18739)
  * Moved jflex from runtime to build dependencies (CASSANDRA-18664)
 Merged from 3.0:
+ * Suppress CVE-2023-6378 (CASSANDRA-19142) 
  * Do not set RPC_READY to false on transports shutdown in order to not fail counter updates for deployments with coordinator and storage nodes with transports turned off (CASSANDRA-18935)
  * Suppress CVE-2023-44487 (CASSANDRA-18943)
  * Fix nodetool enable/disablebinary to correctly set rpc readiness in gossip (CASSANDRA-18935)