Details
-
Fix
-
Status: Released (View Workflow)
-
Minor
-
Resolution: Fixed
-
2.0.0
-
None
-
None
-
CVE-2021-23463
Description
Current Situation
- Currently JOC Cockpit ships with an H2 JDBC Driver h2-1.4.200.jar
- The JDBC Driver and built-in H2 database can be used for evaluation purposes of the JS7.
- H2 is a DBMS preferably designed for testing, not for ongoing operation.
- a vulnerability affects this version,
Desired Behavior
- The JDBC Driver is removed from JOC Cockpit.
- Users who want to evaluate JS7 with an H2 database can download the respective H2 JDBC Driver and specify the JDBC Driver location with the JOC Cockpit setup. The .jar file is then added to the JETTY_BASE/lib/ext/joc directory.
Attachments
Issue Links
- is related to
-
JS-1967 Remove support for H2 due to 3rd-party vulnerability issue CVE-2021-23463
- Released