[ofbiz-framework] branch trunk updated: Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with excessive parts (OFBIZ-12766)

[jl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 42bdd084e6 Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with excessive parts  (OFBIZ-12766)
42bdd084e6 is described below

commit 42bdd084e681268d8301f9c586c13eea5afd6d9b
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Tue Feb 21 08:59:58 2023 +0100

    Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with excessive parts  (OFBIZ-12766)
    
    See
    https://commons.apache.org/proper/commons-fileupload/security-reports.html
    https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71
    for details
---
 build.gradle | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/build.gradle b/build.gradle
index 1a66fb4277..86b0e7ef81 100644
--- a/build.gradle
+++ b/build.gradle
@@ -226,7 +226,7 @@ dependencies {
     implementation 'com.rometools:rome:1.18.0'
     implementation 'com.thoughtworks.xstream:xstream:1.4.19'
     implementation 'commons-cli:commons-cli:1.5.0'
-    implementation 'commons-fileupload:commons-fileupload:1.4'
+    implementation 'commons-fileupload:commons-fileupload:1.5'
     implementation 'commons-net:commons-net:3.8.0'
     implementation 'commons-validator:commons-validator:1.7'
     implementation 'de.odysseus.juel:juel-impl:2.2.7'
@@ -252,8 +252,8 @@ dependencies {
     implementation 'org.apache.tika:tika-parsers:2.5.0'
     implementation 'org.apache.tika:tika-parser-pdf-module:2.5.0'
     implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:3.5.4'
-    implementation 'org.apache.tomcat:tomcat-catalina-ha:9.0.69' // Remember to change the version number (9 now) in javadoc block if needed.
-    implementation 'org.apache.tomcat:tomcat-jasper:9.0.69'
+    implementation 'org.apache.tomcat:tomcat-catalina-ha:9.0.71' // Remember to change the version number (9 now) in javadoc block if needed.
+    implementation 'org.apache.tomcat:tomcat-jasper:9.0.71'
     implementation 'org.apache.axis2:axis2-kernel:1.8.2'
     implementation 'batik:batik-svg-dom:1.6-1'
     implementation 'org.apache.xmlgraphics:fop:2.3' // NOTE: since 2.4 dependencies are messed up. See https://github.com/moqui/moqui-fop/blob/master/build.gradle