Quartz version question

[Sergio]

Hello,

I'm trying to understand which version of quartz is being used by Rundeck.

Looking at the build.gradle file there are two quartz being compiled:

https://github.com/rundeck/rundeck/blob/main/rundeckapp/build.gradle#L74

I wonder why they are compiling two different versions.

This is related to a security scan we did to the Rundeck Docker image and the report contained a vulnerability found in Quartz version 2.3.0 up to 2.3.1

https://nvd.nist.gov/vuln/detail/CVE-2019-13990

[rac...@rundeck.com]

Hi Sergio,

Rundeck 3.4 uses Quartz lib 2.3.2 and Quartz grails plugin 2.0.13. Latest versions in both cases :-)

Hope it helps!

[Sergio]

Oh, I see

So the quartz.jar version 2.0.13 is the grails plugin.

Ok, perfect. I'll check with the security tool to mark it as a false positive.

Thanks!