Require dnsjava 3.6.1 to resolve CVE-2024-25638. This is a transitive…

… dependency from Hadoop. (opensearch-project#4868) Signed-off-by: David Venable <dlv@amazon.com>
dlvenable · Aug 23, 2024 · 49e4b07 · 49e4b07
1 parent 6ca73cd
commit 49e4b07
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/build.gradle b/build.gradle
@@ -79,6 +79,12 @@ subprojects {
         testImplementation testLibs.hamcrest
         testImplementation testLibs.awaitility
         constraints {
+            implementation('dnsjava:dnsjava') {
+                version {
+                    require '3.6.1'
+                }
+                because 'Fixes CVE-2023-39410.'
+            }
             implementation('org.apache.avro:avro') {
                 version {
                     require '1.11.3'