CVE-2024-26308

Advisory

Nextflow updates its Apache Commons Compress library from version 1.21 to 1.26.0 to address CVE-2024-26308.
Note: The Nextflow launcher installer itself does not contain any vulnerable code. However, installing this package will result in using a version of the Nextflow core that may contain known vulnerabilities.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Update Platform API endpoint (4855) [04cedce0]
- Fix semaphore in parallel polling monitor (4927) [d173ceab]
- Fix security vulnerabilities (5014) [a28b404c]
- Bump nf-wave1.0.1-patch1 [3852dd1e]
- Bump nf-tower1.6.3-patch1 [d692711b]
- Bump nf-google1.8.3-patch1 [b48a1423]
- Bump nf-ga4gh1.1.0-patch1 [911c1624]
- Bump nf-console1.0.6-patch1 [9d6b64c3]
- Bump nf-codecommit0.1.5-patch1 [f43964f8]
- Bump nf-cloudcache0.3.3-patch1 [fb9059c7]
- Bump nf-azure1.3.3-patch1 [8c398620]
- Bump nf-amazon2.1.4-patch1 [1d3726db]

Resources

• https://github.com/nextflow-io/nextflow/commit/a28b404c66d422bda34a1bba91406736d80d8dfd
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26308