Avoid vulnerable Oracle JDBC versions#3064
Closed
rukayaj wants to merge 1 commit into
Closed
Conversation
rukayaj
changed the title
Member
|
Thanks for reporting this @rukayaj |
Contributor
Author
|
Yeah it is, well i mean ojdbc11 can be used but we need to make it ojdbc11:23.2.0.0, we can't use the latest ojdbc11 23.26.x release (https://mvnrepository.com/artifact/com.oracle.database.jdbc/ojdbc11/23.26.2.0.0) . I'm checking for security patch updates every day but so far nothing :( |
Member
|
I've added this to the upcoming 3.3.3 release. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GBIF Norway needs to deploy this because of an Oracle Critical Security Patch Update Advisory note, just putting this in a PR in case it's of use to anyone else.
Downgrade
com.oracle.database.jdbc:ojdbc8from23.26.2.0.0to23.2.0.0.Add a Renovate
allowedVersionsguard to avoid reintroducing Oracle JDBC23.4.xthrough23.26.x.Oracle Critical Security Patch Update Advisory - May 2026 lists Oracle Database Server/client-only installations versions
23.4.0-23.26.2as affected by TLS Net Service vulnerabilities, including CVE-2026-46833, CVE-2026-46834, and CVE-2026-46835.Maven Central currently lists
23.26.2.0.0as the latest publishedojdbc8release, so there is no newer fixed Maven artifact to upgrade to yet.23.2.0.0is before the affected range.Once Oracle publishes a fixed version above
23.26.2, such as23.27.xor later, Renovate can propose that update.