You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "J. Casalino (Jira)" <ji...@apache.org> on 2026/02/11 19:52:00 UTC
[jira] [Updated] (SLING-13107) Pipes 4.5.0 vulnerable to CVE-2018-20433
[ https://issues.apache.org/jira/browse/SLING-13107?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
J. Casalino updated SLING-13107:
--------------------------------
Summary: Pipes 4.5.0 vulnerable to CVE-2018-20433 (was: Pipes vulnerable to CVE-2018-20433)
> Pipes 4.5.0 vulnerable to CVE-2018-20433
> ----------------------------------------
>
> Key: SLING-13107
> URL: https://issues.apache.org/jira/browse/SLING-13107
> Project: Sling
> Issue Type: Bug
> Components: pipes, Sling Pipes
> Affects Versions: pipes 4.5.0
> Reporter: J. Casalino
> Priority: Critical
> Labels: SECURITY, Security, security, security-issue, security-review-needed
>
> Sling Pipes 4.5.0 includes a transitive dependency to {{org.codehaus.plexus:plexus-utils@1.0.4}} through {{{}maven-sling-plugin@2.1.0{}}}.
> CVSS reports {{plexus-utils@1.0.4}} contains a Critical vulnerability with a {color:#FF0000}*score of*{color} {color:#FF0000}*9.8*{color}: [https://nvd.nist.gov/vuln/detail/cve-2018-20433]
> An offline conversation with [~cziegeler] via the sling security email list suggests this is only required during build time:
> {code:java}
> The plexus utils are only used at build time during tests, but do> not end up in the final bundle. {code}
> Since this is the case, perhaps we can remove this dependency or update the pom to override the vulnerable version with a fixed version? Either way, the vulnerability should be mitigated.
> Introduced through: com.adobe.<our_bundle_that_uses_pipes>@1.13.7-SNAPSHOT ›
> > > *org.apache.sling:org.apache.sling.pipes@4.5.0* › org.apache.sling:maven-
> > > sling-plugin@2.1.0 › org.apache.maven:maven-archiver@2.0 ›
> > > org.apache.maven:maven-project@2.0 › org.codehaus.plexus:plexus-
> > utils@1.0.4
> > > *Remediation: upgrade `org.codehaus.plexus:plexus-utils` to version*
> > > *3.0.16 or higher.*
--
This message was sent by Atlassian Jira
(v8.20.10#820010)