Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Subject: Re: Release date for Jackrabbit 2.15.7
To: Jan Kreutzfeld <Jan.Kreutzfeld@doubleslash.de>,
 "users@jackrabbit.apache.org" <users@jackrabbit.apache.org>
References: <3a663a2baf0744808a97b200733ce092@FDHMSX01.doubleslash.org>
 <86c51b9e-255c-df5d-8df0-b998fb0037be@gmx.de>
 <abb392d42cf7450a8874becfe5785ee4@FDHMSX01.doubleslash.org>
From: Julian Reschke <julian.reschke@gmx.de>
Message-ID: <0d76aae5-537e-8388-c63f-2e825c1fe3e8@gmx.de>
Date: Mon, 16 Oct 2017 18:47:08 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <abb392d42cf7450a8874becfe5785ee4@FDHMSX01.doubleslash.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
archived-at: Mon, 16 Oct 2017 16:47:21 -0000

On 2017-10-16 18:08, Jan Kreutzfeld wrote:
> I'm referring to this issue: https://www.cvedetails.com/cve/CVE-2015-1832/

Thanks - I don't think that we use that code (worth checking though), so 
this doesn't appear to be urgent.

> As always, we need to get rid of the issue as soon as possible, so we would use the unstable release if necessary.

So which release are you using right now?

> Of course, if a stable release would be available, we would prefer to use that instead.
> So I guess the proper question would be: can you tell me the ETA for the earliest release which updates the derby driver? :-)

Sometimes in November, unless it becomes clear that the vulnerability 
indeed affects Jackrabbit operation.

Best regards, Julian