[jira] [Comment Edited] (DOXIASITETOOLS-229) Struts Core 1.3.10 has CVE problems

["Alexander Kriegisch (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DOXIASITETOOLS-229?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17353403#comment-17353403 ] 

Alexander Kriegisch edited comment on DOXIASITETOOLS-229 at 5/28/21, 3:12 PM:
------------------------------------------------------------------------------

OK, I have no idea about these things. I just inherited a project building a Maven site, that's all. And I see Struts in my dependency tree and Maven Central sending my vulnerability reports. Is Struts an optional dependency which can be safely excluded? Sorry, I rather want to ask a maintainer than play around and maybe make a mistake. I also wanted too bring it to your attention, because one way or another it will be reported by CVE checkers for any project using Doxia Sitetools, so maybe others will ask similar questions in the future.


was (Author: kriegaex):
OK, I have no idea about these things. I just inherited a project building a Maven site, that's all. And I see Struts in my dependency tree. Is Struts an optional dependency which can be safely excluded? Sorry, I rather want to ask a maintainer than play around and maybe make a mistake. I also wanted too bring it to your attention, because one way or another it will be reported by CVE checkers for any project using Doxia Sitetools, so maybe others will ask similar questions in the future.

> Struts Core 1.3.10 has CVE problems
> -----------------------------------
>
>                 Key: DOXIASITETOOLS-229
>                 URL: https://issues.apache.org/jira/browse/DOXIASITETOOLS-229
>             Project: Maven Doxia Sitetools
>          Issue Type: Dependency upgrade
>          Components: Site renderer
>    Affects Versions: 1.9.1, 1.9.2
>            Reporter: Alexander Kriegisch
>            Priority: Major
>
> When publishing artifacts to Sonatype OSSRH staging repositories, Sonatype sends an automatic vulnerability report, such as [this one|https://sbom.lift.sonatype.com/report/T1-0ff0976f7f21c391f20f-dfa463bcb34dd-1622198289-07472a4d66b24ea4b4311d99cb12c09f].
> As you can see, it complains about Struts Core 1.3.10. When running {{mvn dependency:tree}} on my project, I see this (shortened):
> {code}
> +- org.apache.maven.doxia:doxia-site-renderer:jar:1.9.1:compile
> |  +- org.apache.velocity:velocity-tools:jar:2.0:compile
> |  |  +- org.apache.struts:struts-core:jar:1.3.10:compile
> |  |  |  \- antlr:antlr:jar:2.7.2:compile
> |  |  +- org.apache.struts:struts-taglib:jar:1.3.8:compile
> |  |  \- org.apache.struts:struts-tiles:jar:1.3.8:compile
> {code}
> Dependency-managing to Site Renderer 1.9.2 makes no difference, because it still depends on Velocity Tools 2.0 and thus indirectly on Struts Core 1.3.10.
> Can this be fixed? Meanwhile, is there any compatible Struts Core version without the 17 CVEs listed in that report, which I can manage the dependency to in order to get a clean report next time?



--
This message was sent by Atlassian Jira
(v8.3.4#803005)