Details
-
Fix
-
Status: Released (View Workflow)
-
Minor
-
Resolution: Fixed
-
1.12.9
-
None
Description
Current Situation
- Currently JOC Cockpit and JobScheduler uses the c3p0 connection pool version 0.9.5.2.
- A number of vulnerabilities affect this version, see https://www.cvedetails.com/cve/CVE-2018-20433/ and https://www.cvedetails.com/cve/CVE-2019-5427/
Desired Behavior
- Due to vulnerability Issues of older c3p0 releases the JOC Cockpit and JobScheduler should use the current version 0.9.5.4 that fixes the issues.
Maintainer Notes
- Release 1.11 that includes c3p0 version 0.9.5.2 is at its end of life. Therefore no maintenance release is provided.
- Users of release 1.11 should therefore upgrade to release 1.12.