CVE-2022-37734 on graphql-java

[bbakerman]

Some people might start getting notified of a CVE for graphql-java which was released today.

https://www.cve.org/CVERecord?id=CVE-2022-37734

https://security.snyk.io/vuln/SNYK-JAVA-COMGRAPHQLJAVA-3021519

The Snynk document says

How to fix?
Upgrade com.graphql-java:graphql-java to version 19.0 or higher.

This is incomplete. We backported the changes to older versions

The full list of fixed versions is

• v19.0
• v18.3
• v17.4

You don't have to upgrade to the latest graphql-java version to get this fix.

#2549

[dondonz]

We are trying to update the CVE text and we have informed Snyk, so that automated vulnerability detectors correctly register the patched versions. Note this may take a while.

In the meantime please do patch.

[dondonz]

Update: CVE text fixed! https://www.cve.org/CVERecord?id=CVE-2022-37734

[bbakerman]

https://security.snyk.io/vuln/SNYK-JAVA-COMGRAPHQLJAVA-3021519 - Snyk also updated