(tika) branch branch_2x updated: TIKA-4162: exclude uimaj-core from ossindex-maven-plugin

[ti...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tilman pushed a commit to branch branch_2x
in repository https://gitbox.apache.org/repos/asf/tika.git


The following commit(s) were added to refs/heads/branch_2x by this push:
     new 9b8ad9b16 TIKA-4162: exclude uimaj-core from ossindex-maven-plugin
9b8ad9b16 is described below

commit 9b8ad9b16af6831a6edbf1e43eb0a93a8457a3e1
Author: Tilman Hausherr <ti...@apache.org>
AuthorDate: Wed Nov 15 19:13:36 2023 +0100

    TIKA-4162: exclude uimaj-core from ossindex-maven-plugin
---
 tika-parent/pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tika-parent/pom.xml b/tika-parent/pom.xml
index 7814924db..fdf98750e 100644
--- a/tika-parent/pom.xml
+++ b/tika-parent/pom.xml
@@ -1061,6 +1061,14 @@
                 <artifactId>h2</artifactId>
                 <version>2.2.224</version>
             </exclude>
+            <!-- CVE-2023-39913: Uima is used because ctakes is used in the
+            natural language process module. Serialization is only on data that is configured in
+            tika-config.xml. We don't think we'd be vulnerable to crafted user input. -->
+            <coordinate>
+                <groupId>org.apache.uima</groupId>
+                <artifactId>uimaj-core</artifactId>
+                <version>3.4.1</version>
+            </coordinate>
           </excludeCoordinates>
           <fail>true</fail>
         </configuration>