You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@felix.apache.org by "Colm O hEigeartaigh (Jira)" <ji...@apache.org> on 2019/10/17 15:20:00 UTC
[jira] [Created] (FELIX-6193) Update maven-archiver + plexus-utils
Colm O hEigeartaigh created FELIX-6193:
------------------------------------------
Summary: Update maven-archiver + plexus-utils
Key: FELIX-6193
URL: https://issues.apache.org/jira/browse/FELIX-6193
Project: Felix
Issue Type: Improvement
Reporter: Colm O hEigeartaigh
Fix For: maven-bundle-plugin-4.2.2
We should update the versions of maven-archiver + plexus-utils in the maven-bundle-plugin to remove the CVEs:
plexus-archiver-2.8.1.jar (pkg:maven/org.codehaus.plexus/plexus-archiver@2.8.1, cpe:2.3:a:plexus-archiver_project:plexus-archiver:2.8.1:*:*:*:*:*:*:*) : CVE-2018-1002200
plexus-utils-3.0.10.jar (pkg:maven/org.codehaus.plexus/plexus-utils@3.0.10, cpe:2.3:a:plexus-utils_project:plexus-utils:3.0.10:*:*:*:*:*:*:*) : CVE-2017-1000487, Directory traversal in org.codehaus.plexus.util.Expand, Possible XML Injection
--
This message was sent by Atlassian Jira
(v8.3.4#803005)