ML Java Client v2.0.5 - CVE vulnerability (CVE-2014-3577)

[davidbcollins]

A known vulnerability exists in a dependency: CVE-2014-3577.

It is in jersey-apache-client4-1.17.jar.

[sammefford]

Fixed by commit 7a598ca

[sammefford]

That is, my understanding is that the vulnerability is actually in Apache HTTP Client 4.1.1. That commit upgrades from 4.1.1 to 4.5.3, thus overcoming the vulnerability. As long as regression tests are passing, we can deploy this change with version 4.0.2. Soon thereafter, however, the plan is to completely remove Jersey and Apache HttpClient ( #65 ).

[georgeajit]

No regressions due to HttpClient ver 4.5.3. Verified on 05/04/2017 regression run status. Also ran tests locally on Windows laptop with ML Server build 10.0-20170504 and develop branch.