You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ozhera.apache.org by "pjfanning (via GitHub)" <gi...@apache.org> on 2025/03/07 00:21:22 UTC
[I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
pjfanning opened a new issue, #554:
URL: https://github.com/apache/ozhera/issues/554
https://mvnrepository.com/artifact/run.mone/excel/1.5.0-jdk21
POI and XMLBeans have CVEs. Excel is a very exploitable attack vector for malicious actors.
Please ditch run.mone/excel if they can't produce versions that use secure dependencies.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "gaoxh (via GitHub)" <gi...@apache.org>.
gaoxh commented on issue #554:
URL: https://github.com/apache/ozhera/issues/554#issuecomment-2708803228
Thanks to pj, your help and suggestions have given me better ideas and methods to solve the problem.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "gaoxh (via GitHub)" <gi...@apache.org>.
gaoxh commented on issue #554:
URL: https://github.com/apache/ozhera/issues/554#issuecomment-2708643598
> If you look at [XiaoMi/mone#1075](https://github.com/XiaoMi/mone/issues/1075), there are a number of poi and xmlbeans dependencies that seem unnecessary. Some of these jars are large and have CVEs.
Thank you very much for your suggestion, which is very valuable to us. We will solve this problem as soon as possible. I am sorry that we ignored this problem before releasing the version. I am not sure whether this will affect our release of the current version. Can we reflect the fix of this problem in the next version?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "gaoxh (via GitHub)" <gi...@apache.org>.
gaoxh commented on issue #554:
URL: https://github.com/apache/ozhera/issues/554#issuecomment-2708644279
> This looks like a simple task. Maybe we can pin this issue as a `good first issue` for a new contributor? [@gaoxh](https://github.com/gaoxh)
That's a good suggestion, we'll improve it right away.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on issue #554:
URL: https://github.com/apache/ozhera/issues/554#issuecomment-2706843626
If you look at https://github.com/XiaoMi/mone/issues/1075, there are a number of poi and xmlbeans dependencies that seem unnecessary. Some of these jars are large and have CVEs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "gaoxh (via GitHub)" <gi...@apache.org>.
gaoxh closed issue #554: [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies
URL: https://github.com/apache/ozhera/issues/554
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on issue #554:
URL: https://github.com/apache/ozhera/issues/554#issuecomment-2708787950
I have raised no issues that block the current RC from being released.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org
Re: [I] [SECURITY] run.mone:excel has dangerously outdated poi and xmlbeans dependencies [ozhera]
Posted by "psxjoy (via GitHub)" <gi...@apache.org>.
psxjoy commented on issue #554:
URL: https://github.com/apache/ozhera/issues/554#issuecomment-2708377425
This looks like a simple task.
Maybe we can pin this issue as a `good first issue` for a new contributor? @gaoxh
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@ozhera.apache.org
For additional commands, e-mail: commits-help@ozhera.apache.org