Repository navigation
[T2.18] Apache Derby 10.14.2.x hardening (7 CVEs) #242
Description
Summary
All 7 catalogued CVEs are closed by being at the latest Java 1.8 line (Tier 1 PR #79); T2.18 is defense in depth. Mitigation: drops -noSecurityManager, adds 5 derby.properties for bind / connectionLimit / networkTimeoutSeconds / SHA-256 / saltLength. Closing PR: #171 (issue #170).
Mitigation matrix
See docs/SECURITY-MITIGATIONS.md T2.18 entry.
Closing evidence
docs/SECURITY-MITIGATIONS.mdT2.18 entryowasp-suppressions.xml- Merged PR: fix(security): T2.18 Derby 10.14.2.0 hardening: drop -noSecurityManager, add 5 derby.properties (issue #170) #171
Activity
docs(security): bulk backfill owasp-suppressions.xml + SECURITY-MITIG…
fix(security): T2.14 hardening: Hibernate ORM 5.6.15 + Validator 6.2.…
natechadwick-intsof commentedon Sep 17, 2026
Closing this sub-task
Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on
main:docs/SECURITY-MITIGATIONS.mdhas the per-GAV mitigation table for this sub-taskowasp-suppressions.xmlhas per-GAV<suppress>entries with<notes>describing the mitigation, pointing back at this issue and the merged PR(s)No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.