pending-upstream-fix advisory for tez: GHSA-pr98-23f8-jwxv

Signed-off-by: Mark McCormick <[email protected]>
wolfi-dev · Jan 17, 2025 · 31ab236 · 31ab236
1 parent 1ab1f83
commit 31ab236
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/tez.advisories.yaml b/tez.advisories.yaml
@@ -125,6 +125,13 @@ advisories:
             componentType: java-archive
             componentLocation: /usr/share/java/tez/lib/logback-core-1.2.10.jar
             scanner: grype
+      - timestamp: 2025-01-17T20:11:12Z
+        type: pending-upstream-fix
+        data:
+          note: |
+            logback-core is brought in as a transitive dependency.
+            Attempts to patch pom.xml were not successful in remediating this CVE.
+            Pending fix from upstream.
 
   - id: CGA-459v-8fm2-rw72
     aliases: