[jira] [Comment Edited] (WAGON-612) Update jsoup to >= 1.14.2 for fix security issue

["Michael Osipov (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WAGON-612?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17419922#comment-17419922 ] 

Michael Osipov edited comment on WAGON-612 at 9/24/21, 6:27 PM:
----------------------------------------------------------------

To make it clear: The feature exposed through Wagon API with JSoup is **not** used in Maven Resolver and Maven at all. There is no security risk.


was (Author: michael-o):
To make it clear. The feature exposed through Wagon API with JSoup is **not** used in Maven Resolver and Maven at all. There is no security risk.

> Update jsoup to >= 1.14.2 for fix security issue
> ------------------------------------------------
>
>                 Key: WAGON-612
>                 URL: https://issues.apache.org/jira/browse/WAGON-612
>             Project: Maven Wagon
>          Issue Type: Dependency upgrade
>          Components: wagon-http
>    Affects Versions: 3.4.3
>            Reporter: Nikolay Krasko
>            Priority: Minor
>
> There's a vulnerability report for the jsoup <= 1.14.2 [https://www.cvedetails.com/cve/CVE-2021-37714|https://www.cvedetails.com/cve/CVE-2021-37714/]
> jsoup:1.12.1 is used by wagon-http-shared:3.4.3, that triggers security bots alerts. 
> Please could you update the dependency and release a new version?



--
This message was sent by Atlassian Jira
(v8.3.4#803005)