You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by me...@apache.org on 2023/12/16 21:54:52 UTC
(myfaces-html5) branch main updated: vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#3)
This is an automated email from the ASF dual-hosted git repository.
melloware pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/myfaces-html5.git
The following commit(s) were added to refs/heads/main by this push:
new b0447c9 vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#3)
b0447c9 is described below
commit b0447c94b32f1ece750c26255cb4c7fc01a6ad60
Author: Jonathan Leitschuh <jo...@gmail.com>
AuthorDate: Sat Dec 16 16:54:48 2023 -0500
vuln-fix: Use HTTPS instead of HTTP to resolve deps CVE-2021-26291 (#3)
This fixes a security vulnerability in this project where the `pom.xml`
files were configuring Maven to resolve dependencies over HTTP instead of
HTTPS.
Weakness: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Severity: High
CVSS: 8.1
Detection: CodeQL & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)
Reported-by: Jonathan Leitschuh <Jo...@gmail.com>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/8
Detection: CodeQL (https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url/) & OpenRewrite (https://app.moderne.io/recipes/org.openrewrite.maven.security.UseHttpsForRepositories)
Reported-by: Jonathan Leitschuh <Jo...@gmail.com>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/8
Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/IfHkrYfxx?organizationId=QWxsIEdpdEh1Yg%3D%3D
Co-authored-by: Moderne <te...@moderne.io>
---
myfaces-html5-demo/pom.xml | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/myfaces-html5-demo/pom.xml b/myfaces-html5-demo/pom.xml
index 34f4412..3caab2d 100644
--- a/myfaces-html5-demo/pom.xml
+++ b/myfaces-html5-demo/pom.xml
@@ -37,7 +37,7 @@
<repositories>
<repository>
<id>java.net</id>
- <url>http://download.java.net/maven/2</url>
+ <url>https://download.java.net/maven/2</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
@@ -46,7 +46,7 @@
<repository>
<id>Maven2 Repo1</id>
<name>Maven2 Repo1</name>
- <url>http://repo1.maven.org/maven2</url>
+ <url>https://repo1.maven.org/maven2</url>
<layout>legacy</layout>
<snapshots>
<enabled>false</enabled>
@@ -56,7 +56,7 @@
<repository>
<id>java.net.2</id>
<name>java.net Maven 2 Repository</name>
- <url>http://download.java.net/maven/2</url>
+ <url>https://download.java.net/maven/2</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
@@ -65,7 +65,7 @@
<repository>
<id>codehaus</id>
<name>codehaus</name>
- <url>http://repository.codehaus.org</url>
+ <url>https://repository.codehaus.org</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
@@ -74,7 +74,7 @@
<repository>
<id>jboss</id>
<name>jboss</name>
- <url>http://repository.jboss.com/maven2</url>
+ <url>https://repository.jboss.com/maven2</url>
<snapshots>
<enabled>false</enabled>
</snapshots>
@@ -84,7 +84,7 @@
<repository>
<id>myfaces-snapshots</id>
<name>myfaces-snapshots</name>
- <url>http://people.apache.org/repo/m2-snapshot-repository</url>
+ <url>https://people.apache.org/repo/m2-snapshot-repository</url>
<snapshots>
<enabled>true</enabled>
</snapshots>