In-Memory Data Grid - achieve unparalleled speed, persistence, and accuracy.Third-Party License Agreements
This page list all the third-party libraries shipped included within GigaSpaces products on a per-version basis, and their respective license agreements.
The following does not include notice regarding any dependency or sub-dependency of the open source software listed below. However, you may find information about such dependency or sub-dependency in the link provided with regard to each such open source.
Any enquiries regarding the open source components listed below may be addressed to our support team.
| Product | Version | License | Required | Component |
|---|---|---|---|---|
| Security | 1.6 | Sun | Yes | Data Grid |
| Apache Commons | 1.x-2.x | Apache2 | Yes | Data Grid |
| Spring | 5.3.29 | Apache2 | Yes | Data Grid |
| Spring Security | 5.7.5 | Apache2 | No | Data Gride |
| ASM (see Note below) | 9.5 | INRIA | No | Data Grid |
| OSHI | 5.2.5 | MIT | No | Data Grid |
| JNA | 5.6.0 | Apache2 | No | Data Grid |
| HyperSonic SQL | 1.8.0 | Hypersonic SQL | No | Data Grid |
| H2 | 1.2 | H2 | No | Data Grid |
| Velocity | 1.5 | Apache2 | No | Data Grid |
| Maven | 3.6.3 | Apache2 | No | Data Grid |
| Ant | 1.9.4 | Apache2 | No | Data Grid |
| Apache Zookeeper | 3.6.3 | Apache2 | No | Data Grid |
| Netty (sub-dependency of Zookeeper) | 4.1.86 | Apache2 | No | Data Grid |
| Apache Curator | 5.2.1 | Apache2 | No | Data Grid |
| Apache Spark | 2.4.4 | Apache2 | No | Analytics |
| Apache Zeppelin | 0.8.2 | Apache2 | No | Analytics |
| SLF4J | 1.7.26 | Apache2 | No | Logging |
ASM (Java bytecode manipulation framework): Until version 16.3.0, GigaSpacesbundles ASM v3.3.1.
Starting with ASM v4.0, there was a breaking change made to their API, specifically converting interfaces to classes, e.g., ClassVisitor and Method Visitor.
In GigaSpaces16.4, the bundle was updated to include ASM v9.5, mainly to support future upgrades to Java 11.
| Product | Version | License |
|---|---|---|
| Google Web Toolkit | 2.4.0 | Apache2 |
| FileUpload | 1.2.2 | Apache2 |
| gwtupload | 0.6.3 | Apache2 |
| Commons Lang | 2.6 | Apache2 |
| Highcharts | 2.1.9 | Commercial |
| Ext GWT | 2.2.5 | Commercial |
| jQuery | 1.8.1 | MIT |
| Raphaël | 2.1.0 | MIT |
| Dracula Graph | 0.0.3 | MIT |
| CCombo V2.0 | 2.0 | MIT |
| SexyCombo | 2.1.3 | MIT |
| GwtQuery | 1.1.0 | Apache2 |
| CodeMirror | 2.3.4 | MIT |
| Apache Commons Math v2.1 | 2.1 | Apache2 |
| Fugue Icons | 3.5.6 | Creative Commons |
| Alphanum Comparator | LGPL | |
| Jackson | 1.9.9 | LGPL |
| JGit | 2.2.0 | EDL |
| slf4j | 1.7.2 | MIT |
| JCTerm | 0.0.11 | GNU LGPL |
| JSch | 0.1.48 | BSD |
| JZlib | 1.1.1 | BSD |
| D3 | 3.2.7 | BSD |
Calcite 1.25.0 known vulnerabilities are CVE-2022-39135 and CVE-2020-13955.
-
CVE-2022-39135 is an XML External Entity (XEE) vulnerability that allows an SQL query to read the contents of files via the SQL functions of EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM or EXTRACT_VALUE.
GigaSpaces Analysis: GigaSpaces is NOT affected by this vulnerability as we do not expose these SQL operators to clients.
-
CVE-2020-13955 is a vulnerability which exploits a utility class provided by Apache Calcite (HttpUtils#getURLConnection) to create vulnerable HTTPS connections for other applications by disabling verification.
GigaSpaces Analysis: GigaSpaces is NOT affected by this vulnerability as we do not use this utility method to create HTTP connections, using instead the default JVM
Java Virtual Machine. A virtual machine that enables a computer to run Java programs as well as programs written in other languages that are also compiled to Java bytecode. truststore.