You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by GitBox <gi...@apache.org> on 2020/12/01 15:17:04 UTC
[GitHub] [maven] dja-fr opened a new pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
dja-fr opened a new pull request #406:
URL: https://github.com/apache/maven/pull/406
Update resolver from 1.4.1 to 1.6.1
No Jira open on this subject
https://nvd.nist.gov/vuln/detail/CVE-2020-15777
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] michael-o commented on pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
michael-o commented on pull request #406:
URL: https://github.com/apache/maven/pull/406#issuecomment-736620449
How is a Gradle issue related to Maven Resolver. Moreover, you are sitting on old code:https://github.com/apache/maven/blob/b6cf7109523e77c0a9c9a0cbf3f9759de8973e6d/pom.xml#L68
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] michael-o commented on pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
michael-o commented on pull request #406:
URL: https://github.com/apache/maven/pull/406#issuecomment-737479193
We haven't received anything through security@apache.org so I'd say no. Please clarify with your security scanner vendor.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] michael-o closed pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
michael-o closed pull request #406:
URL: https://github.com/apache/maven/pull/406
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] lvincel edited a comment on pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
lvincel edited a comment on pull request #406:
URL: https://github.com/apache/maven/pull/406#issuecomment-736633573
@michael-o Sure but isn't the 3.6.3 (the latest available publicly) packaged with the 1.4.1 resolver dependency that is the subject of this CVE ?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] michael-o commented on pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
michael-o commented on pull request #406:
URL: https://github.com/apache/maven/pull/406#issuecomment-736656985
I still don't understand how Gradle relates to Maven Resolver here. Please explain.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] lvincel commented on pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
lvincel commented on pull request #406:
URL: https://github.com/apache/maven/pull/406#issuecomment-736633573
Sure but isn't the 3.6.3 (the latest available publicly) packaged with the 1.4.1 resolver dependency that is the subject of this CVE ?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [maven] lvincel commented on pull request #406: [Fix] Security resolver 1.4.1 CVE 2020-15777
Posted by GitBox <gi...@apache.org>.
lvincel commented on pull request #406:
URL: https://github.com/apache/maven/pull/406#issuecomment-737094812
Us too, our several security scans each flag maven-resolver-*.1.4.1.jar involved in this CVE, we manually upgraded from the maven 3.6.3 release those libraries to 1.6.1, and it's fine now. The question we have is : Are those libraries causing the potential risk or is it the use that gradle did do with them that caused the risk in which case the CVE flags the wrong libraries; this is unclear.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org