- Security Fix (open-metadata#15664)

gorgias · Mar 22, 2024 · cb411d0 · cb411d0
1 parent fb8b8c4
commit cb411d0
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 12 deletions.
diff --git a/openmetadata-service/pom.xml b/openmetadata-service/pom.xml
@@ -47,8 +47,18 @@
           <groupId>org.slf4j</groupId>
           <artifactId>slf4j-api</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>com.nimbusds</groupId>
+          <artifactId>nimbus-jose-jwt</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
+    <!--  Upgrading due to CVE in com.nimbusds:nimbus-jose-jwt  -->
+    <dependency>
+      <groupId>com.nimbusds</groupId>
+      <artifactId>nimbus-jose-jwt</artifactId>
+      <version>9.37.3</version>
+    </dependency>
     <dependency>
       <groupId>org.pac4j</groupId>
       <artifactId>pac4j-oidc</artifactId>
@@ -106,8 +116,8 @@
       <artifactId>dropwizard-jdbi3</artifactId>
     </dependency>
     <dependency>
-      <groupId>mysql</groupId>
-      <artifactId>mysql-connector-java</artifactId>
+      <groupId>com.mysql</groupId>
+      <artifactId>mysql-connector-j</artifactId>
     </dependency>
     <dependency>
         <groupId>org.postgresql</groupId>
@@ -269,13 +279,6 @@
       <artifactId>azure-identity</artifactId>
       <version>${azure-identity.version}</version>
     </dependency>
-    <!--  Upgrading due to CVE in com.nimbusds:nimbus-jose-jwt  -->
-    <dependency>
-      <groupId>com.nimbusds</groupId>
-      <artifactId>nimbus-jose-jwt</artifactId>
-      <version>9.37.3</version>
-    </dependency>
-
     <dependency>
       <groupId>io.dropwizard.modules</groupId>
       <artifactId>dropwizard-web</artifactId>

diff --git a/pom.xml b/pom.xml
@@ -100,7 +100,7 @@
     <flyway.version>9.22.3</flyway.version>
     <redshift-jdbc.version>2.1.0.25</redshift-jdbc.version>
     <gson.version>2.10.1</gson.version>
-    <mysql.connector.version>8.0.33</mysql.connector.version>
+    <mysql.connector.version>8.3.0</mysql.connector.version>
     <postgres.connector.version>42.7.2</postgres.connector.version>
     <jsonschema2pojo.version>1.2.1</jsonschema2pojo.version>
     <commons-lang.version>2.6</commons-lang.version>
@@ -305,8 +305,8 @@
         </exclusions>
       </dependency>
       <dependency>
-        <groupId>mysql</groupId>
-        <artifactId>mysql-connector-java</artifactId>
+        <groupId>com.mysql</groupId>
+        <artifactId>mysql-connector-j</artifactId>
         <version>${mysql.connector.version}</version>
         <exclusions>
           <exclusion>